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1.0 Introduction 


Under the guidance of processes provided by Crew Transportation Plan (CCT-PLN-1100), this 
document with its sister documents, Crew Transportation Technical Management Processes (CCT- 
PLN-1120), Crew Transportation Technical Standards and Design Evaluation Criteria (CCT-STD- 
1140), and Crew Transportation Operations Standards (CCT-STD-1150), and International Space 
Station (ISS) to Commercial Orbital Transportation Services Interface Requirements Document (SSP 
50808), provides the basis for a National Aeronautics and Space Administration (NASA) certification 
for services to the ISS for the Commercial Provider. When NASA Crew Transportation System (CTS) 
certification is achieved for ISS transportation, the Commercial Provider will be eligible to provide 
services to and from the ISS during the services phase of the NASA Commercial Crew Program (CCP). 


The CTS has two top-level objectives in support of the NASA mission of providing services to the ISS. 
The primary objectives are to provide for crew rotation capability for four NASA or NASA-sponsored 
crewmembers, henceforth called NASA crew, and to provide for an emergency crew return capability 
for these crewmembers at any time while the commercial spacecraft is docked to the ISS. Secondary 
objectives include transporting a limited amount of ISS Program-specified pressurized cargo to the ISS, 
returning pressurized cargo from the ISS, and providing for a crew safe haven capability when the 
spacecraft is docked to the ISS. The Design Reference Mission (DRM) for ISS can also be found in 
CCT-DRM-1110. 


The spacecraft will be capable of transporting NASA crew to the ISS and docking 24 hours after launch. 
Mission launch opportunities must be accomplished within NASA-specified timeframes to 
accommodate ongoing ISS science operations and to minimize ISS traffic model impacts associated 
with other visiting vehicles. Prior to launch, the CTS supports a NASA-provided pre-launch health 
stabilization program for NASA crew. The CTS also assures comparable health stabilization for any 
other crewmembers. Within a few hours of launch, NASA completes their crew medical assessments 
and baseline data collection process in NASA-provided facilities and hands the crew over to the CTS 
provider for transportation to the launch site. The NASA flight surgeons will serve as the physicians for 
the NASA crew during all phases of flight. 


Lift-off occurs when the launch site passes through the ISS’s orbital plane. Daily launch opportunities 
then depend on the resulting phasing; an everyday launch opportunity is desirable, but not required. 
Launch and ascent into the 51.6 degree inclination must meet Range Safety constraints associated with 
the launch site. Following ascent, an orbital insertion maneuver is executed and becomes the first of 
several orbital rendezvous maneuvers to be performed. These maneuvers bring the spacecraft closer 
towards the ISS. ISS standard communications are used when the spacecraft closes to within tens of 
kilometers to the ISS and ship-to-ship voice communications are established. Relative navigation is 
performed by the spacecraft using available cooperative and non-cooperative assets on the ISS. 
Communication and telemetry monitoring will be shared between the Commercial Vehicle Control 
Center (CVCC) and the ISS mission control facilities, Mission Control Center - Houston (MCC-H). 
MCC-H Mission Authority will be established to ensure ISS, spacecraft, and crew safety. When in close 
proximity to the ISS, after receiving approval from both the spacecraft and MCC-H, the spacecraft 
begins a final approach to a NASA-specified docking port on the ISS. After docking, the vestibule 
between the ISS and the spacecraft is pressurized and verified not to be leaking. The spacecraft hatches 
are opened and the crew transfers into the ISS, placing the newly arrived spacecraft in a quiescent state. 
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If the nominal docking attempt is not successful, or if an anomaly occurs near docking which would 
prevent docking at the nominal opportunity, the spacecraft backs out to a short safe distance and 
performs necessary reconfigurations, followed by a second approach and docking attempt. If that 
docking is also unsuccessful, the spacecraft will separate from the ISS vicinity on a collision-free safe 
trajectory and the spacecraft will prepare for a final re-rendezvous and docking attempt on the following 
crew day. If this final docking attempt is unsuccessful, the mission will be terminated, and the crew will 
return to Earth. 


Because of the short time duration from launch to docking, internal maintenance of the spacecraft should 
not be necessary, nor should the crew require certain complex habitability items for food and waste 
management that can be found on longer duration vehicles, like the Space Shuttle or the ISS. 


Extravehicular Activity (EVA) will not occur because the complexity of preparing for and executing an 
EVA is precluded due to the short time in the spacecraft early in the mission. Similarly, EVA will not 
be performed during the short free-flight duration from undocking to landing. 


The spacecraft will be designed to be attached to the ISS for 210 days, although nominal crew rotations 
will occur at approximately 180-day intervals. The spacecraft remains quiescent and requires minimal 
maintenance during docked operations. The CVCC will provide routine, periodic support for these 
docked operations, in association with MCC-H. The ISS will provide power and environmental 
resources to the spacecraft in order to maintain the vehicle in a return-to-Earth ready state. 


Due to limitations in the number of docking ports on the ISS, the spacecraft may need to be relocated 
from one docking port to another during ISS increment operations to provide operational flexibility. To 
accomplish this relocation, the spacecraft’s full crew complement will ingress the spacecraft, close the 
hatch, and the spacecraft will be relocated from one port to the other port. The crew needs to be in the 
spacecraft to protect from the potential failure to re-mate with a docking port and preserve assured return 
for the crew. 


When docked to the ISS, the spacecraft also provides a contingency “safe haven” capability allowing the 
crew to retreat to the spacecraft, close the hatch, and remain in a safe environment for up to 24 hours. If 
necessary, the spacecraft atmosphere will be purged during this activity. The ISS will provide attitude 
control during this 24-hour period. After the ISS returns to a habitable environment state, the crew will 
open the hatch and re-enter the ISS. If the ISS cannot achieve a habitable state during this period, the 
crew will return to Earth. 


While docked to the ISS, the spacecraft will also serve as an emergency return vehicle for contingencies 
requiring the return of the crew brought to the ISS. Emergencies could result from ISS system failures, 
an uninhabitable crew environment, or a medical event requiring the return of the crewmembers. The 
crew will return to Earth within 24 hours of a declaration of an intention to return early. The crew will 
be fully trained to execute these contingency return-to-Earth operations, landing at a location where 
rescue is likely to be most expedient. 


Due to the limited size and power available, the spacecraft is expected to have basic first aid and life 
support capability to respond to immediate medical conditions in the free-flight mode. 


The launch of the next rotation mission may occur prior to the departure of the current increment crew 
working on the ISS, resulting in a handover period where two commercial spacecraft would be docked 
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to the ISS for approximately 7 to 10 days. If the Commercial Provider has received NASA approval to 
fly non-NASA crew to the ISS, the spacecraft will need to provide food, water, clothing, Environmental 
Control and Life Support System (ECLSS) consumables, and other logistics for these crewmembers for 
the docked timeframe, since NASA does not generally pre-position these supplies on the ISS. 


After handover is complete, the current increment crew will return in the spacecraft. They will enter the 
spacecraft, perform a vehicle health check, close hatches, depress the vestibule, perform a hatch leak 
check to verify seal integrity, and depart from the ISS. When available consumables permit, the 
spacecraft will potentially circumnavigate the ISS while in proximity to assess the external configuration 
of the ISS prior to final departure. During this circumnavigation, the crew will capture imagery to allow 
post-flight analysis of the ISS configuration. 


The timeframe from undocking through landing is envisioned to be a short 4 to 8 hour free-flight 
duration. Landing will occur on the continental United States (U.S.) land mass or waters directly 
extending from the coast for nominal landing. This reduces risk by minimizing rescue force assets, 
increasing proximity to U.S. medical facilities, increasing security, and ensuring a prepared landing site 
free of hazards. If the nominal deorbit maneuver is waived-off after separation from the ISS, a 
subsequent landing at an alternate landing site, with nearby recovery forces, will be possible. The 
spacecraft may also perform orbital maneuvers in low Earth orbit (LEO) to better accommodate 
alternate landing sites. Returning crew will be deconditioned and potentially have impaired 
musculoskeletal, cardiopulmonary, and neurovestibular capabilities as a result of long duration exposure 
to the micro-gravity and space environment, resulting in degraded crewmember performance in the post- 
landing timeframe. Because of the deconditioned state of the crew, special considerations need to be 
provided for crew recovery, medical care, and other post-landing care activities. 


Upon arrival at the landing location, the NASA crew will be met with a recovery crew that will assist the 
astronauts in egress operations and removal of time-critical cargo. NASA personnel will begin post- 
flight medical and science evaluations soon after egress is complete in a temporary facility at the landing 
location. Subsequently, the NASA flight crew, NASA support personnel, and time-critical cargo will be 
transported by a CTS element to a staging location where handover will be completed and the NASA 
crew and cargo will be flown back to Houston using NASA assets. 


After recovery operations are complete, the spacecraft will be safed and transported to a location for 
subsequent post-flight evaluation. 


1.1. Purpose 


The purpose of this document, hereafter referred to as CCT-REQ-1130, is to provide the requirements 
for development (design, manufacturing, testing, qualification, production, and operation) of 
commercial services to deliver NASA crew and limited cargo to and from the ISS. The intent of this 
document is that all CTS requirements are to be fulfilled by the Commercial Provider; however, it may 
be more practical for NASA to provide the consumables or hardware associated with a particular 
function. This document clearly states when a function or hardware is the responsibility of NASA. 


1.2 Scope 

These services and design requirements were developed by the CCP and the ISS Program for the crew 
transportation system. This document is clearly divided into ISS destination services requirements in 
Section 3.1 and transportation certification requirements in Sections 3.2 through 3.11. 
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The CTS refers to all assets and services required to meet the requirements of CCT-REQ-1130, 
including pre-flight planning, trajectory and abort analysis, ground processing and manufacturing, 
ground operations, mission control, training, launch control, post-landing recovery operations, safety 
and mission assurance, and all other functions required for safe and successful human space flight 
missions. Other key definitions include integrated space vehicle, which will be used when discussing 
the launch vehicle and spacecraft. The spacecraft is also known as the “crewed element” and serves as 
the crew rescue or crew transfer vehicle, while the “launch vehicle” is the element that provides the 
propulsion systems necessary to transport the spacecraft to the desired insertion orbit. Another term that 
is utilized throughout this document is NASA crew, which consists of all crewmembers sponsored by 
NASA, including both International Partners (IP) and NASA astronauts. 


1.3 Precedence 


In the event of a conflict between the text of this document and references cited herein (listed in Section 
2.0), the text of this document takes precedence. The exception to this statement is for SSP 50808, 
which takes precedence during ISS integrated operations. Nothing in this document supersedes 
applicable laws and regulations unless a specific exemption has been obtained. 


In the event of conflict between this document and any spreadsheet exports of the NASA requirements 
database, the contents of this document take precedence. 


1.4 Delegation of Authority 


This document was jointly prepared by and will be jointly managed by the CCP and the ISS Program. 
The Joint Program Requirements Control Board (JPRCB) is the authority for baselining and approving 
changes to this document. CCT-REQ-1130 will be maintained in accordance with standards for the 
CCP documentation. The CCP is responsible for assuring the definition, control, implementation, and 
verification of the requirements identified in this document. Coordination with the ISS Program for 
verification and eventual certification of the requirements identified as ISS driven requirements will be 
performed through the CCP. 


1.5 Verb Application and Document Detail 


When used within the context of a requirement under a contract, statements in this document containing 
shall are used for binding requirements that must be verified and have an accompanying method of 
verification; will is used as a statement of fact, declaration of purpose, or expected occurrence; and 
should denotes an attribute or best practice which must be addressed by the system design. When used 
within the context of a reference document under an agreement, the verbs shall, will, and should are only 
intended as informational and are not binding. 


In some cases, the values of quantities included in this document have not been confirmed and are 
designated as: “To Be Confirmed” (TBC) - still under evaluation, and “To Be Determined” (TBD) or 
“To Be Supplied” (TBS) - known, but not yet available. A "To Be Resolved" (TBR) is used when there 
is a disagreement on the requirement between technical teams. When a change in a noted characteristic 
is deemed appropriate, notification of the change shall be sent to the appropriate review and change 
control authority. 


Each requirement in CCT-REQ-1130 is annotated by its section number. At the end of each 
requirement text is a requirement ID of the format R.CTS. This corresponds to the absolute ID in 
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NASA’s requirements database. It can be used to cross reference requirements in this document to 
spreadsheet exports of the database. See Section 1.3 in the event of conflict between this document and 
spreadsheet exports. 
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2.0 Documents 


The following design, manufacturing, testing, and quality control standards apply to all space flight 
hardware and software, including the launch vehicle, all portions of the spacecraft, and any launch abort 
system. There are also specific standards for ground support equipment (GSE), along with software 
standards for ground software that are needed to perform a primary mission objective, have direct 
interaction with human space flight systems, or have a direct impact on the health and safety of the crew. 


NASA has identified three basic types of standards: 


1. One type of standard must be followed completely with no deviation or alternative 
proposal. They are identified by the words “meet” within the corresponding sections of this 
document. Within the Applicable Documents list below these standards will be shown as fully 
applicable. Verification language for these technical standards that must be met can be found in 
Section 4.0 of this document. Any Applicable Document listed within these “meet” documents 
are considered to be “meet the intent of” documents and alternative standards can be proposed. 


2. The majority of the standards identified are standards which use the language “meet the intent 
of.” These contain requirements that can be met explicitly by following the standard or by 
proposing alternate standards that meet or are consistent with the requirement levied in the 
NASA Standard. It should be understood that the applicable documents called out by “meet the 
intent of” standards from CCT-REQ-1130 are also considered “meet the intent of” standards. 
Within the Applicable Documents list below these standards will be shown as “Alternative 
Allowed.” Because these standards are unique, CCT-STD-1140 was developed to define some 
specific criteria utilized by NASA to evaluate and approve alternative standards. The process 
and product defined in the respective sections of CCT-STD-1140 define the details of how any 
proposed alternative standards will be evaluated along with the key aspects of items proposed as 
part of the verification. The Requirements Applicability Matrix in Section 2.1 of CCT-STD- 
1140 provides a mapping of the sections that discuss the details of each standard where an 
alternative is allowed. The specific verification language for each of these alternative standards 
will be partnered with NASA after an agreement is reached on the alternative standard. 
Verification language for these technical standards that must be met or complied with can be 
found in Section 4.0 of this document. Similar to Engineering Standards, Human System 
Integration Design Requirements are listed in Appendix Q and are invoked by the “meet the 
intent” requirement 3.10.1. Alternatives to the children requirements in Appendix Q can be 
proposed. 


3. There are many other standards that may be utilized in the design and manufacturing process and 
for standard operations. These are the third type of NASA standard and many of these 
documents can be found in the reference documents in Section 2.2. These technical standards 
are reference and will have no verification language attached. CCT-STD-1150 was developed to 
define specific criteria for operations spanning the interval from integrated vehicle assembly, 
test, and integration at the launch site through recovery of NASA crew and cargo at the landing 
site(s). The products and processes defined in the respective sections of CCT-STD-1150 discuss 
in detail how operational standards will be evaluated. 
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2.1 


Document 
Number 


ANSI S3.2- 
2009 


ANSI Z136.1- 
2007 


ANSI/ESD 
$20.20 


EPA Method 


524.2 


EPA Method 
625 


Revision 


BL (1/1/07) 


Edition 07 
(6/19/08) 
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Applicable Documents 


Title 


American National 
Standard Method for 
Measuring the 
Intelligibility of 
Speech over 
Communicating 
System 

The American 
National Standard 
for Safe Use of 
Lasers 

For the Development 
of an Electrostatic 
Discharge Control 
Program for - 
Protection of 
Electrical and 
Electronic Parts, 
Assemblies and 
Equipment 
(Excluding 
Electrically Initiated 
Explosive Devices) 
Measurement of 
Purgeable Organic 
Compounds in Water 
by Capillary Column 
Gas 
Chromatography/Ma 
ss Spectrometry 
Methods for Organic 
Chemical Analysis of 
Municipal and 
Industrial 
Wastewater, Base 
Neutrals and Acids 


CCT-REQ- 
1130 
Location 


3.10.4.8, 
4.3.10.4.8, 
2.6.3, 
Q.6.3V 


3.10.6.3.2, 
4.3.10.6.3.2 


BO Snl3.2, 
439.3132 


Appendix G, 
Table G-1 


Appendix G, 
Table G-1 


Applicability 


ALL 
LL 
ALL 
L 


CCT-REQ-1130 
Revision: E-1 


Alternative 
Documents 
(Allowed/Not 
Allowed) 

Not Allowed 
for 3.10.4.8, 
4.3.10.4.8, 
Allowed for 
Q.6.3, Q.6.3V 


Not Allowed 


Allowed 


Not Allowed 
Not Allowed 


Page 11 of 295 


ISS Crew Transportation and 
Services Requirements Document 


Document 
Number 


FAA AC 20- 
136B 


Federal 
Information 
Processing 
Standard 
(FIPS) 
Publication 
197 

FIPS 
Publication 
140-2 


GEIA-STD- 
0005-1 


GEIA-STD- 
0005-2 


BL (9/7/11) 


BL 
(11/26/01) 


BL 
(5/25/01) 
with change 
2, 3, and 4 
12/2002 


BL 
(6/1/06) 


BL 
(6/1/06) 


Title 


Protection of Aircraft 
Electrical/Electronic 
Systems Against the 
Indirect Effects of 
Lightning 

Advanced Encryption 
Standard (AES) 


Security 
Requirements for 
Cryptographic 
Modules, Level 2 
Certification 
Performance 
Standard for 
Aerospace and High 
Performance 
Electronic Systems 
Containing Lead- 
Free Solder 
Standard for 
Mitigating the Effects 
of Tin Whiskers in 
Aerospace and High 
Performance 
Electronics 


CCT-REQ- 
1130 
Location 


395474, 
439. FA 7d 


93/53; 
LE ees i) 


BD: A, 
43.93.74 


Applicability 


CCT-REQ-1130 
Revision: E-1 


Alternative 
Documents 
(Allowed/Not 
Allowed) 


Allowed 
Not Allowed 


Allowed 


_ 
7 
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Document Revision Title CCT-REQ- 
Number 1130 
Location 


IEC 61000-4-2 | Edition Electromagnetic I 935133, 
2.0 Compatibility (EMC) | 4.3.9.3.13.3 
Testing and 
Measurement 
Techniques- 
Electrostatic 
Discharge Immunity 
Test for Human Body 
Model (HBM) 
subassemblies, 
assemblies and 
equipment discharge 
levels 


IPC-2152 Standard for 3.9.3.3.3, 
ee Determining Current | 4.3.9.3.3.3 
Carrying Capacity in 
Printed circuit Board 
Design 
IPC-2220 : Family of Printed Biel oon! L. 
Series : Board Performance | 4.3.9.3.3.1 
Documents 


IPC-6010 : Family of Printed 3.9,3,3.2, 
Series : Board Performance | 4.3.9.3.3.2 
Documents 


CCT-REQ-1130 
Revision: E-1 


Allowed) 


Allowed 


Applicability | Alternative 
Documents 
(Allowed/Not 

- 

- 


IPC-CM-770E | E Component SO, ALL Allowed 
(1/1/04) Mounting Guidelines | 4.3.9.3.12.2 
for Printed Boards 


IPC J-STD- Requirements for D9 S.7 ds 
OO1E Soldered Electrical 4.3.9.3.7.1 
and Electronic 
Assemblies 
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Document Revision Title CCT-REQ- | Applicability | Alternative 
Number 1130 Documents 
Location (Allowed/Not 
Allowed) 

IPC J-STD- Space Applications Soi Are ALL Allowed 
001ES Electronic Hardware | 4.3.9.3.7.1 
Amendment 1 Addendum to J-STD 

OOL1E, Requirements 

for Soldered 

Electrical and 

Electronic 

Assemblies 
ISBN 2005 American Public 4.3.10.19.1, | ALL Not Allowed 
0875530478 Health Association, 4.3.10.19.2 

Standard Methods 

for Examination of 

Water & Wastewater 
ISO 2631-1: Mechanical 4.3.10.2.6 Not Allowed 
1997 Vibration and Shock 

- Evaluation of 

Human Exposure to 

Whole-Body 

Vibration 


ISO E Ergonomics — Appendix Q, | Only Sections | Allowed 
7731:2003 Danger signals for 4.2.2.2 and 

public work areas 3.2.2.1 ate 

Auditory danger applicable 

signals 


JSC 20584 B Spacecraft Maximum | 3.2.5.2, ALL Not Allowed 
(11/08) Allowable 3.10.11.1.3, for 3.2.5.2, 
Concentrations for 3.10.12.3, 3.10.11.1.3, 
Airborne LES BOO 3.10.12.3, 
Contaminants 4.3.10.11.1.3 Al 3) DS). 
543 LO 12S, 4.3.10.11.1.3, 
Appendix Q 4.3.10.12.3, 
Allowed for 
Appendix Q 


is 
JSC 20793 C Crewed Space 3.9.3.11.1, Allowed 
Vehicle Battery 4.3.9.3.11.1 
Safety Requirements 
(3.9.3.11.1) 
JSC 22538 D (11/10) Flight Crew Health | 3.6.4, 4.3.6.4 | ALL Not Allowed 
Stabilization 
Program 
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Document Revision Title CCT-REQ- | Applicability | Alternative 
Number 1130 Documents 
Location (Allowed/Not 
Allowed) 


JSC 26895 BL Guidelines for 310122 ALL Not Allowed 
(10/97) Assessing the Toxic 
Hazard of Spacecraft 
Chemicals and Test 
Materials 
JSC 62809 Human Rated ALL Allowed 
Spacecraft 
Pyrotechnic 
Specification 
JSC 63414 BL Spacecraft Water Appendix G, | ALL Not Allowed 
(11/08) Exposure Guidelines | Table G-1 
(SWEG) 
JSC 65827 A Thermal Protection Allowed 
System Design 
Standard for 
Spacecraft 


Allowed 


JSC 65828 B-1 Structural Design 3.9.8.1.1, ALL 
Requirements and 4.3.9.8.1.1, 
Factors of Safety for 
Spaceflight 
Hardware 
JSC 65829 A Loads and Structural | 3.9.8.2.1, ALL Allowed 
Dynamics 4.3.9.8.2.1, 
Requirements for Appendix E 
Spaceflight 
Hardware 


JSC 65985 A Requirements for 3.9.4.1.1, 
Human Spaceflight 4.3.9.4.1.1 
for the Trailing 
Deployable 
Aerodynamic 
Decelerator (TDAD) 

JSC 66320 A Optical Property 
Requirements for 
Glasses, Ceramics, 
and Plastics in 
Spacecraft Window 
Systems 
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Allowed 


Not Allowed 
for 3.1.5.4; 
Allowed for 
Q.5.8 
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Services Requirements Document 

Document Revision Title 

Number 

MIL-STD-461 | F Requirements for the 
Control of 
Electromagnetic 
Interference 
Characteristics of 
Subsystems and 
Equipment 

MIL-STD-464 | C Electromagnetic 
Environmental 
Effects Requirements 
for Systems 

MIL-STD-981 | C Design, 

(7/1/10) Manufacturing and 

Quality Standards 
for Custom 
Electromagnetic 
Devices for Space 
Applications 

MSFC-DWG- | E (1/15/92) | Assessment of 

20M02540 Flexible Lines for 
Flow-Induced 
Vibration 

MSFC-SPEC- | Basic Test Control 

626 (5/11/90) Document for 
Assessment of 
Flexible Lines for 
Flow Induced 
Vibration 

NASA-STD- A Electrical Bonding 

4003 (2/5/13) For NASA Launch 
Vehicles, Spacecraft, 
Payloads, And Flight 
Equipment 


CCT-REQ- 
1130 
Location 


3.9.3.14.1, 
4.3.9.3.14.1 


ID SAS, 
43.9: 3.15.1 


3.9.3.16, 
4.3.9.16.3.1 


3.9.3.10.1, 
4,3.9,3.10.1, 
02.6V 


Applicability 


AL. 
AL 


CCT-REQ-1130 
Revision: E-1 


Alternative 
Documents 
(Allowed/Not 
Allowed) 


Allowed 


Allowed 


Allowed 


NASA-STD- BL Low Earth Orbit 3.9.3.13.1, AL Allowed 
4005 (6/3/07) Spacecraft Charging | 4.3.9.3.13.1 
Design Standard 


NASA-STD- A Strength and Life 

5012 (1/16/15) Assessment 
Requirements for 
Liquid Fueled Space 
Propulsion System 
Engines 
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3.9 107, 
4.3.9.10.1 


L 
L 
LL 
L 
L 
L 
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Document Revision 
Number 
NASA-STD- Design and 
5017 Development 


Requirements for 
Mechanisms 


Fracture Control 
Requirements For 
Spaceflight 


NASA-STD- 

5019 
Hardware 

NASA-STD- Requirements for 

5020 (3/12/12) Threaded Fastening 
Systems in 
Spaceflight 
Hardware 

NASA-STD- B Standard Materials 

6016 (7/11/08) and Processes 
Requirements for 
Spacecraft 


L 
L 
L 
(1/7/08) 
L 
L 
L 


NASA-STD- Strength Design and 

5018 Verification Criteria 
for Glass, Ceramics, 
and Windows in 
Human Spaceflight 
Applications 


B 
B 
B 
B 


CCT-REQ- 
1130 
Location 


3.95.1, 
3.10.16.3, 
4.5.9 Dds 
Appendix E 
998.12, 
ee 


S111, 
4.3.9.11.1 


Applicability 


Sections 4.7 
and 4.8.9 are 


not applicable 


Sections 4.6.3, 


5.6.3, 
4.10.2 and 


5.10.2 are not 


applicable 


CCT-REQ-1130 
Revision: E-1 


Alternative 
Documents 
(Allowed/Not 
Allowed) 


Allowed 


Allowed 


_ 
7 
ALL 


Allowed 


NASA-STD- B Standard for Models | 3.9.14.1 AL Ili, 442. Allowed 
7009 (7/11/08) and Simulations 4.7, 4.8 


NASA-STD- A w/ Workmanship 
8739.1 change 2 Standard for 
(3/29/11) Polymeric 
Assemblies 

NASA-STD- BL w/ Crimping, 

8739.4 change 6 Interconnecting 
Cables, Harnesses, 
and Wiring 

NASA-STD- BL w/ Fiber Optic 

8739.5 change 2 Terminations, Cable 
Assemblies, and 
Installation 


Application on 
Commercial Crew Program 


NASA-STD- A w/ Process for Limiting 
8719.14 change 1 Orbital Debris 
Electronic 
International Space Station Program 


3.4.3.1, 
4.3.4.3.1 


393504) 
437 5.0.1 


i Poe Be 


4.3.9.3.8.1 


Soe, 
4.3.9.3.5.2 


Allowed 


Allowed 
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Document Revision CCT-REQ- | Applicability | Alternative 
Number 1130 Documents 
Location (Allowed/Not 
Allowed) 


National Radiation Protection | 4.3.10.6.2.1 | Tables 4.2 and | Not Allowed 
Council on Guidance for 4.3 

Radiation Activities in Low- 

Protection Earth Orbit 

and 

Measurement 

s (NCRP) 

Report 

Number 132 


NPR 7150.2A NASA Software SES oe is AL Allowed 
a 1/19/09) | Engineering 4.3.9.2.] 
Requirements 


NPR 8715.5 Range Flight Safety | 3.3.3.2, Not Allowed 
Program 4.3.3.3.2 


National Jeriat iL Recommendation for Not Allowed 
Institute of Rev. 3 Key Management — 
Standards and Part 1 
7/12 
Technology Ue 
(NIST) SP 
800-57 


SAE ARP Aircraft Lightning S317; Allowed 
5412A Environment and 4.3.9.3.17.1 

Related Test 

Waveforms 


SAE ARP ee ea Lightning 3 Paeeo| DLs. ALL Allowed 
5414A ee ea 4. Paeeo| Dri aeal 


SAE ARP Basic Aircraft Lightning 3. coe a eee Allowed 
5577 (9/1/02) Direct Effects 4.3.9.3.17.1 
Certification 


SAE-AS-7928 General haem Sats Not Allowed 
a 1/11) Specification for 4.3.9.3.8.1 
Terminals, Lug: 
Splices, Conductor: 
Crimp Style, Copper 


SMC Space and Missile 3.9, 12.1, Allowed 
Standard en 12/09) Systems Center 4.3.9.12.1 
SMC-S-010 Standard, Parts, 

Materials, and 

Processes Technical 

Requirements for 

Space and Launch 

Vehicles 


Commercial Crew Program 
International Space Station Program Page 18 of 295 


ISS Crew Transportation and 
Services Requirements Document 


Document Revision Title 


Number 


SMC 
Standard 
SMC-S-016 
(2008) 


SSP 30512 Cc 

(6/3/94) 
SSP 41172 
SSP 42014 a 


6/13/08 Test Requirements 
for Launch, Upper- 
Stage, and Space 


Vehicles 


Space Station 
Ionizing Radiation 
Design Environment 
Qualification and 
Acceptance 
Environmental Test 
Requirements 

Crew Health System 
(CHeCS) to Lab 
Interface Control 
Document 
International Space 
Station Flight Crew 
Integration Standard 


7 
: 


Commercial Crew Program 
International Space Station Program 


International Space 
Station to 
Commercial Orbital 
Transportation 
Services Interface 
Requirements 
Document 


CCT-REQ-1130 
Revision: E-1 


CCT-REQ- 
1130 
Location 


Alternative 
Documents 
(Allowed/Not 
Allowed) 
Allowed 


Applicability 


Pee ee aes 
4.3.9.13.1 


3.10.6.2.1, Not Allowed 
4.3.10.6.2.1 
4.3.10.12.3 we Not Allowed 


3.6.2, 4.3.6.2 | Section Not Allowed 


3.10.4.5, 
4.3.10.4.5, 
OFT, 
OZTY, 
O6V, 


Not Allowed 
for 3.10.4.5, 
4.3.10.4.5, 
Allowed for 
OA) 2 iN 
Q.3.6V 


Sections 
63.34, 
6.3.5.2. 
6.3.33; 
6.3.3.4, 
6.33.5; 
6.3.3.8, 
6.3.3.9; 
6.3.3.1), 
9.4.4.3, 9.5.3.2 


ay 
3.1.3.4, 
3.1.3.0); 
S155, 
3.2.4.2, 
3.4.2.5, 
SAL, 
3.8.1.5, 
SIO PILL, 
310129, 
4 Sekalaly 
ie a OEP 
4.3.4.1.1, 
Appendix P 


Not Allowed 


Page 19 of 295 


ISS Crew Transportation and 
Services Requirements Document 


Document Revision 
Number 


SSP 50833 B 
(2/15) 


Commercial Crew Program 
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CCT-REQ- 
1130 
Location 


ISS Cargo Transport 
Requirements 
Document 


Applicability 


Only Sections 
3.1.1 and 3.1.2 
are applicable 


CCT-REQ-1130 
Revision: E-1 


Alternative 
Documents 
(Allowed/Not 
Allowed) 

Not Allowed 
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2.2. Reference Documents 


This section will provide a list of documents and technical and manufacturing standards that can be used 
as a reference during the launch vehicle, spacecraft, and ground system design activities. Additional 
reference documents for a variety of technical disciplines can be found in CCT-STD-1140. 


Document Revision Title 
Number 


10 CFR 20.1003 Title 10 — Energy; Chapter I -- Nuclear Regulatory Commission; 
Part 20 -- Standards for Protection Against Radiation; Subpart A -- 
General Provisions 


ACGIH TLVs American Conference of Governmental Industrial Hygienists 
and BEI (ACGIH) standard, Threshold Limit Values® and Biological 
(2007) Exposure Indices® 


AFSPCMAN 91- (an Air Force Space Command Range Safety User Requirements 
710 


AGARD-CP-472 Development of Acceleration Exposure Limits for Advanced Escape 
Systems (Brinkley, J.W.; Specker, L.J.; Armstrong, H.G.; Mosher, 
S.E. (February 1990). AGARD-CP-472. Implications of Advanced 
Technologies for Air and Spacecraft Escape.) 


ATAA- ae ales Systems — Moving Mechanical Assemblies for Space and 
(Pale Vehicles, January 1, 2005 (provided as reference) 


nana Manual Safe Use of Oxygen and Oxygen Systems: Guidelines for Oxygen 

36 System Design, Materials Selection, Operations, Storage, and 
Transportation 

ee (ee ee 
Environments (DSNE) 
(NEDD); 


Exploration Architecture Requirements Document 
FAA HFDS Human Factors Design Standard 


——4 
—— 
re ae Government-Industry Data Exchange (GIDEP) Operations Manual 
BT-PRO-010 
by lI lied 
BU-GYD-010 Guide 


Goddard Space Flight Center Rules for the Design, Development, 


GSFC-STD-1000 
Verification, and Operation of Flight Systems 


HRP-47072 | —s—| Risk of Orthostatic Intolerance During Re-exposure to Gravity 


IEEE 730-2002 Institute of Electrical and Electronic Engineers (IEEE) Standard 
for Software Quality Assurance Plans 


IEEE C95.1 Standard for Safety Levels with Respect to Human Exposure to 
Radio Frequency Electromagnetic Fields, 3 kHz to 300 GHz — 
Description 


ISO 13407 |__| Human-Centered Design Processes for Interactive Systems 
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ISO 6954-2000 


JPR 8080.5 
JSC 63828 


JSC 64548 


KSC-NE-9439 
MIL-STD-1472F | F 


MIL-STD-1474 


Mechanical Vibration-Guidelines for the Measurement, Reporting, 
and Evaluation of Vibration with regard to Habitability on 
Passenger and Merchant Ships 


JSC Design and Procedural Standards 
Bio-Safety Review Board Operations and Requirements Document 


Anthropometric and Strength Selection criteria for Astronaut 
Applicants 


Commercial Human Systems Integration Requirements 
Commercial Medical Operations Requirements Document 


KSC Design Engineering Handbook for Design and Development 
Department of Defense Design Criteria Standard, Human 


Department of Defense Design Criteria Standard, Noise Limits 


Fracture Control Implementation Handbook for Payloads 
Experiments, and Similar Hardware 


Man-Systems Integration Standards 


=e 
et 
NASA-HDBK- BL 
5010 
NASA-STD-3000 
Volume I — II 
NASA-STD-3001 NASA Space Flight Human System Standard Volume 1: Crew 
Volume 1 Health 
N 7 
V 

as 


Load Analyses of Spacecraft and Payloads 


9 
6105 
NASA/SP-2008- 
NASA/SP-2010- 
NASA/TM-2008- 
NASA TM-2013- 
217380 


NESC-RP-06- 
108/05-173-E 


Standard for the Design and Fabrication of Ground Support 
Equipment (GSE) 


VASA-STD-3001 NASA Space Flight Human System Standard Volume 2: Human 
olume 2 Factors, Habitability, and Environmental Health 
NASA Systems Engineering Handbook 


Aerospace Vehicle Development 
Application of the Brinkley Dynamic Response Model to Spacecraft 
Transient Events 
Design, Development Test and Evaluation (DDT&E) 
Considerations for Safe and Reliable Human Rated Spacecraft 
Systems 
Non-Government | 8" Edition | ACSM’s Guidelines for Exercise Testing and Prescription, 8" 
Document Edition. 2000. Franklin BA, Whaley MH, Howley ET (eds). 
Philadelphia. Lippincott, Williams & Wilkins. 
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Non-Government Lockheed Engineering and Science, Computer Program 
Document Documentation 41-node Transient Metabolic Man Program, 
Lockheed Engineering and Sciences Company, Inc., 1989. 


Rees ee ea Jakob Nielsen, Usability Engineering, Morgan Kaufmann, Boston, 

Document 1993, ISBN 978-0125 184069. 

Non-Government Stone, R.W., & Letko, W. (1965) “Some observations on the 

Document stimulation of the vestibular system of man in a rotating 
environment,” in NASA SP-77 "The Role of the Vestibular Organs 
in the Exploration of Space," pp. 263-278. 


id SS a 
Spacecraft, Instruments, and Launch Services 
NPD 8710.5 |D___| Policy for Pressure Vessels and Pressurized Systems 


NPD 8730.2 NASA Parts Policy 
NPD 8730.5 ‘B _| NASA Quality Assurance Program Policy 


NPD 8900.1 G Medical Operations Responsibilities in Support of Human Space 
Flight Programs 


NPD 8900.5 NASA Health and Medical Policy for Human Space Exploration 
NPR 2810.1 Security of Information Technology 


NPR 7120.5 NASA Space Flight Program and Project Management 
Requirements 


NPR 8621.1 NASA Procedural Requirements for Mishap and Close Call 
ei Reporting, Investigating, and Recordkeeping 

_NPR 8705.2B |B | NASA Human-Rating Requirements for Space Systems 
NPR 8705.5 A Technical Probabilistic Risk Assessment (PRA) Procedures for 
AORSIES|* | Sut andntison Suis or NASA Pogamsand Pee, 


NPR 8715.3 NASA General Safety Program Requirements 


NPR 8735.1 Procedures for Exchanging Parts, Materials, and Safety Problem 
Data Utilizing the Government-Industry Data Exchange Program 
(GIDEP) and NASA Advisories 


NWC TP 6575 /_| Parachute Recovery System Design Manual 


RTCA DO-160E | E Environmental Conditions and Test Procedures for Airborne 
Equipment 


SAE ARP5416 | _| Aircraft Lightning Test Methods 


SSP 30575 a Space Station Interior and Exterior Operational Location Coding 
System 


SSP41000 |__| System Specifications forthe ISS 
SSP 50200 |__| Station Program Implementation Plan Volume9 
SSP 50260 | | ISS Medical Operations Requirement Document 
SSP 50505 | | Basic Provisions on Crew Actions in Case of Fire onthe ISS 
SSP 50506 |__| Basic Guidelines for Crew Activities During ISS Depressurization _ 
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SSP 50653-1 = Basic Provisions on Crew Actions in the Event of a Toxic Release 
on ISS 


SSP 57000 |---| Pressurized Payload Interface Requirements Document 
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3.0 ISS Crew Transportation and Service Requirements 


3.1. ISS Destination Services 
3.1.1 Top Level System 
3.1.1.1 Launch Rate 
The CTS shall be capable of at least two crewed launches to the ISS per year. [R.CTS.001] [I] 


Rationale: A normal ISS increment is 180 days, requiring a new replacement crew to be 
launched approximately two times per year. 


3.1.1.2 Simultaneous Operation of Spacecraft 


The CTS shall simultaneously operate two spacecraft, to allow an ISS NASA crew handover. 
[R.CTS.002] [1] 


Rationale: The launch of the next rotation mission may occur prior to the departure of the 
current increment crew working on the ISS, resulting in a direct crew handover period where 
two commercial spacecraft would be docked to the ISS for approximately 7 to 10 days. The 
communication infrastructure in the spacecraft, CVCC, network, and other required assets 
must be sized to accommodate two operational spacecraft (one docked and one in free-flight 
mode or both docked). 


3.1.1.3 ISS Operations Impacts 


The CTS shall not impact ISS operations due to real-time commanding, or active monitoring, 
during ISS docked operations, except for periodic vehicle maintenance as defined in requirement 
3.8.3.1. [R.CTS.003] [I] 


Rationale: ISS crew time is reserved for science and other operations. The spacecraft design 
should not require commanding, active monitoring, and maintenance during quiescent 
docked operations to avoid impacts to the ISS crew science productivity. Additionally, this 
will reduce the overall burden on the ground infrastructure required to support this 
spacecraft while docked to the ISS. Periodic vehicle maintenance with a maximum crew 
impact is defined in requirement 3.8.3.1. 


3.1.1.4 EVA Operations 


The CTS shall complete the mission without requiring an EVA for nominal operations, 
contingency operations, or to perform maintenance activity. [R.CTS.004] 


Rationale: EVA will not occur because of the short time in the spacecraft early in the mission 
when the complexity of preparing for and executing an EVA precludes that activity. EVAs 
during the docked timeframe impact ISS crew time, consumables, and on-going science 
activities. Finally, the timeframe at the end of the flight is envisioned to be a short free-flight 
duration from undocking to landing, which precludes EVA. 


3.1.1.5 Provide Supplies 


The CTS shall provide all equipment, supplies, and consumables to support all crewmembers 
during any portion of the mission when the crew will occupy the spacecraft in a hatch-closed 
configuration. [R.CTS.005] [I] 
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Rationale: Unless specifically noted in requirement 3.1.1.6 or SSP 50808, the CTS must 
provide all the supplies necessary for space flight to meet the functions described in CCT- 
REQ-1130. 


3.1.1.6 Transport NASA-Provided Supplies 


The spacecraft shall accommodate and utilize the NASA-provided supplies for NASA crew to 
include the following items: Environmental Health Kit, Food and Utensils, Contamination 
Cleanup Kit, Passive Radiation Area Monitors, Crew Personal Dosimeters, Medical Kit, ISS 
Medical Accessory Kit (IMAK), Crew Worn-On Items, and ISS Crew Provisions. 


a. The spacecraft shall accommodate a total of 85 kg (187 Ibs) of NASA-provided supplies. 


b. The spacecraft shall provide a total of 0.323 cubic meters (11.4 cubic feet) of NASA- 
provided supplies stowage volume. [R.CTS.336] [I] 


Rationale: NASA has determined that certain items, such as food, clothing, personal 
dosimeters, a medical kit, and an environmental kit, will be provided to the NASA crew since 
many of these items will be the same product that they will use on their 180 day stay on the 
ISS. A notional list of NASA-provided supplies for NASA crew with mass and volumes can be 
found in Appendix J for reference. Some items in the NASA-provided supplies are driven by 
the operational timelines and contingency days. The base value for food was chosen in 
accordance with the notional timeline in Appendix P. For mission durations greater than 
this, additional food would be required. It is easier for the crew to have the same individual 
item and familiarity and training with the common items (e.g., Medical Kit) during both the 
free-flight and docked portions of the mission. For these items, the spacecraft must provide 
the appropriate stowage and interfaces to properly store the equipment prior to use. These 
items are not cargo or payload and are in addition to the 100 kg of cargo called out in 
requirement 3.1.3.1. 


3.1.1.7 Supplies for Non-NASA Crew 


The CTS shall provide habitable consumables, such as food, water, clothing, oxygen, nitrogen, 
CO2 removal, personal hygiene, and other required consumables, for non-NASA crew during the 
docked portion of the mission when the non-NASA crewmembers are on the ISS. [R.CTS.006] 
[I] 

Rationale: For any mission model that requires additional crew beyond the 4 NASA crew 
required for the ISS increment, the CTS will be responsible for carrying the required 

logistics in the spacecraft to support the additional crewmembers during docked timeframe. 
NASA will not have the ability to pre-position supplies on ISS via another cargo launch 
vehicle due to the required ISS logistics support via Cargo Resupply Contract (CRS), 
Progress, and Automated Transfer Vehicle (ATV)/H-II Transfer Vehicle (HTV) vehicles. 

Thus, the CTS will be responsible for providing food, water, clothing, and other logistics for 
non-NASA crew. The nitrogen only needs to be provided if any equipment or operation to 
support the non-NASA crew is venting air overboard as part of its nominal operation. 


3.1.1.8 NASA Crew 


The CTS shall accommodate 1, 2, 3, and 4 NASA crewmembers during a single mission. 
[R.CTS.389] [I] 
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Rationale: Four NASA crew are required to be transported and returned to the ISS during a 
single mission to meet the United States Operations Segment (USOS) demand for crew time 
based on full utilization of the ISS to perform science and support the ISS National 
Laboratory Program. All docking and undocking operations are a significant impact to the 
completion of ISS science, resulting in the determination by the ISS Program that the most 
efficient crew rotations strategy is to launch and return 4 crewmembers on a single vehicle. 
Additionally, the CTS must be able to perform the mission with crew complements of 1, 2, 3, 
or 4 crewmembers in a single launch or landing to provide flexibility in the ISS crew rotation 
plan. 


3.1.2 Crew Transportation 
3.1.2.1 Transport Crew 
The CTS shall transport NASA crew to the ISS. [R.CTS.010] []] 


Rationale: NASA crew are required to be transported to the ISS to meet the United States 
Operations Segment (USOS) demand for crew time based on full utilization of the ISS to 
perform science and support the ISS National Laboratory Program. 


3.1.2.2 Return Crew 


The CTS shall return NASA crew from the ISS. [R.CTS.011] [I] 


Rationale: NASA crew are required to be returned from the ISS to meet the United States 
Operations Segment (USOS) demand for crew time based on full utilization of the ISS to 
perform science and support the ISS National Laboratory Program. 


3.1.2.3, Docked Duration 


The spacecraft shall be capable of being docked to the ISS for 210 days to provide an assured 
crew return capability for 4 NASA crew. [R.CTS.012] [I] 


Rationale: The ISS requires continuous presence of the spacecraft to support sustained 
operations. The 210 days provides 30 days of contingency on the nominal 180 day 
turnaround. 


3.1.2.4 Rotation Intervals 


The CTS shall be capable of exchanging up to 4 NASA ISS crewmembers every 150 to 210 
days. [R.CTS.013] [1] 


Rationale: The nominal crew rotation will occur at approximately 180 days based on the ISS 
human research program medical data collection needs. It is possible for this rotation to be 
altered by one month (earlier or later) in order to accommodate other overall ISS Program 
requirements or anomaly resolution/response. 


3.1.2.5 Launch Sites 


The CTS shall launch from a U.S. (or U. S. State Department approved) launch site(s). 
[R.CTS.014] 


Rationale: Launching from a designated U.S. (or U.S. State Department approved) launch 
sites reduces risk by minimizing necessary abort recovery force assets, increasing proximity 
to U.S. medical facilities, increasing security, and ensuring a prepared launch and 
emergency landing site, which minimizes unknown hazards and potential security issues. 
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3.1.2.6 Landing Sites 


The CTS shall return the NASA ISS crew to a designated primary landing site for nominal 
landings. [R.CTS.015] 


Rationale: Returning to a designated continental U.S. landing site or waters directly 
extending from the coast reduces risk by minimizing necessary recovery force assets, 
increasing proximity to U.S. medical facilities, increasing security, and ensuring a prepared 
landing site free of hazards. Deconditioned crewmembers have impaired musculoskeletal, 
cardiopulmonary, and neurovestibular capabilities as a result of long duration exposure to 
the micro-gravity and space environment, resulting in degraded crewmember performance in 
the post-landing timeframe. Because of the deconditioned state of the crew, special 
considerations need to be provided for medical and other post-landing care. 


3.1.3 Cargo Transportation 


This cargo includes any NASA items (ISS maintenance hardware, powered payloads, etc.), but 
does not include any required items for spacecraft maintenance, food, water, clothing, hygiene or 
other crew provisions, medical or environmental kits, documentation or other equipment required 
to operate the spacecraft, etc. These items required for crew sustenance and operations of the 
spacecraft will be provided by the CTS and will be allocated mass and volume in addition to 
cargo goals defined below. 


3.1.3.1 Accommodate Soft Stowage Cargo 


The spacecraft shall accommodate 100 kg (220.5 Ibm) of soft stowage cargo in the pressurized 
volume during a single mission. 


a. The spacecraft shall provide a total of 0.227 cubic meters (8 cubic feet) of pressurized 
volume to accommodate standard soft stowage cargo. 


b. The spacecraft shall provide a contiguous volume with the dimensions 0.468 m x 0.556 m x 
0.6245 m (18.4 in x 21.9 in x 24.6 in) within the 0.227 cubic meters (8 cubic feet) volume to 
accommodate time critical cargo. 


c. The spacecraft shall provide soft stowage cargo accommodations per requirements in SSP 
50833, ISS Cargo Transport Requirements Document, Section 3.1.2, except for Triple CTB's 
in section 3.1.2.1 and all M-Bags in section 3.1.2.2. [R.CTS.016] [I] 


Rationale: The 100 kg, 0.227 cubic meter cargo requirement is sized to transport a small 
amount of ISS Program-specified cargo inside the spacecraft to be transferred to the ISS 
upon arrival. The cargo will be contained in either a standard set of ISS soft stowage cargo 
to easily accommodate transfer by the crew onorbit. The dimensions of 0.468 m x 0.556 m x 
0.6245 m (18.4 in x 21.9 in x 24.6 in) and volume of 0.1625 cubic meters (5.74 cubic feet) are 
equivalent to a double-middeck locker and was chosen such that it would be a candidate 
location for the hard mounted cargo swap required by requirement 3.1.3.5. The cargo in 
this volume (whether hard mounted or soft stowage) must be accessible as time-critical 
cargo. Maximum flexibility in configuring the cargo items is important since failures of 
hardware components on the ISS will be a factor in the cargo items manifested on a given 
CTS mission. 


3.1.3.2 RESERVED 
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3.1.3.3 Cargo in lieu of Crew 


The spacecraft shall accommodate an additional 100 kg (220.5 Ibm) of soft stowage cargo in lieu 
of a NASA crewmember during a single mission per requirements in SSP 50833, Section 3.1.2, 
except for Triple CTB's in section 3.1.2.1 and all M-Bags in section 3.1.2.2. [R.CTS.020] [I] 


Rationale: The transport of an additional 100 kg of soft stowage cargo in lieu of a NASA 
crewmember provides the capability to react to situations that dictate the timely delivery and 
return of ISS components, supplies, and science hardware due to operational needs of the 
ISS. Obviously, maximum flexibility in the size, volume, and mass is important to 
accommodate a wide range of potential cargo. The concept proposed is that the seat would 
be removed to allow for a cargo pallet or other structure to be flown in its place in order to 
properly restrain the cargo. 


3.1.3.4 Accommodate Hard Mounted Cargo 


The spacecraft shall accommodate hard mounted time-critical cargo consisting of either two 
powered single middeck lockers or one powered double middeck locker in the pressurized 
volume during a single mission, and maintain cargo services per requirements in SSP 50833, 
Section 3.1.1 while installed. 


a. The spacecraft shall accommodate time-critical, soft stowage cargo in lieu of the hard 
mounted cargo per requirements in SSP 50833, section 3.1.2, except for Triple CTB's in 
section 3.1.2.1 and all M-Bags in section 3.1.2.2. [R.CTS.021] [I] 


Rationale: The intent of this requirement is to allow for the transport of time-critical cargo in 
a powered middeck locker or lockers. ISS power necessary for the locker(s) will be provided 
from docking until payload transfer in addition to, not in lieu of, all other power allocations 
specified herein or within SSP 50808, such as requirement 3.4.2.5, ISS Safe Haven or SSP 
50808 3.2.2.4.1.3, Power Consumption. The mass and volume associated with transport of 
the locker(s) are required in addition to, not in lieu of or included within, all other mass and 
volume requirements specified herein, i.e., the 10Okg (220.5 lb) of pressurized cargo defined 
in requirements 3.1.3.1 and 3.1.3.5. The middeck locker(s) would be provided by the ISS 
Program either prior to launch or during onorbit operations to be transported to or from the 
ISS with a known quantity of science samples inside. When the need arises, operational 
flexibility is required to allow the ISS Program to fly additional passive cargo within the 
mass and volume of the powered lockers. 


3.1.3.5 Hard Mounted Cargo in lieu of Soft Stowage Cargo 


The spacecraft shall accommodate additional time-critical hard mounted cargo consisting of 
either two powered single middeck lockers or one powered double middeck locker, during a 
single mission in lieu of the soft stowage cargo required by 3.1.3.1. 


a. The spacecraft shall provide the additional hard mounted cargo per requirements in SSP 
50833, Section 3.1.1. 


b. The spacecraft shall provide at least 220W power and 220W heat rejection for the sum of all 
cargo in lieu of the power wattages defined in SSP 50833, Sections 3.1.1.3.1 and 3.1.1.5.3. 
[R.CTS.383] []] 

Rationale: Due to the shortfall in powered cargo transport needed to support ISS research, 

the ISS program needs the ability to fly additional powered payloads instead of the passive 
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payloads specified in 3.1.3.1. The intent of this requirement is to allow for the transport of 
scientific samples in a powered middeck locker or lockers. ISS power necessary for the 
locker(s) will be provided from docking until payload transfer in addition to, not in lieu of, 
all other power allocations specified herein or within SSP 50808, such as 3.4.2.5 ISS Safe 
Haven or SSP 50808, 3.2.2.4.1.3 Power Consumption. The middeck locker(s) would be 
provided by ISS either prior to launch or during onorbit operations to be transported to or 
from ISS with a known quantity of science samples inside. 


3.1.3.6 Time-Critical Cargo Pre-Launch Handling 


The CTS shall maintain cargo services per SSP 50833, Sections 3.1.1 and install time-critical 
cargo within 24 hours of a scheduled launch. [R.CTS.018] [J] 


Rationale: Once time-critical cargo has been handed over from the ISS program, it is critical 
that cargo services be maintained to ensure the integrity of the cargo. Late cargo 
installation, within 24 hours of scheduled launch, is required to maintain the integrity of 
time-critical cargo. The CTS may select the specific integration window, as long as it is 
within 24 hours of scheduled launch. This requirement addresses both soft stowage and hard 
mounted time-critical cargo. The time-critical cargo installation may include an Integrated 
Verification Test (IVT) to verify the interface between the spacecraft and the payload and 
must be completed within the L-24 window of opportunity. Once installed, the CTS must 
maintain cargo services, if required, until the cargo is removed for transfer to the ISS. In the 
event that a launch is scrubbed or delayed and rescheduled, access to remove and re-install 
the time-critical cargo would need to be provided as well. 


3.1.3.7 Time-Critical Cargo Removal 


The CTS shall remove ISS time-critical cargo from the spacecraft no later than | hour after crew 
egress, post-docking and post-landing at a supported landing site. [R.CTS.019] [I] 


Rationale: Early cargo access after spacecraft docking and landing is required to maintain 
the integrity of time-critical cargo. On orbit, the ISS crew must perform post-docking 
procedures quickly such that the cargo transfer can also occur no later than one hour after 
crew egress from the spacecraft. The CTS will provide the capability to retrieve time-critical 
cargo within I hour upon completion of crew egress after post-landing and post-docking, 
while also providing continuous cargo services, per SSP 50833. 


3.1.3.8 Docked Cargo Services 


The spacecraft shall maintain cargo services per SSP 50833, Sections 3.1.1, for 48 hours post- 
docking and pre-undocking. [R.CTS.394] [I] 


Rationale: The ISS program requires the operational flexibility to best utilize crew time and 
manage the crew day. Mission priorities may preclude cargo transfer immediately following 
docking or prior to undocking requiring the spacecraft to maintain the specified environment 
and services until cargo transfer can be completed. In these scenarios, the spacecraft will 
receive the necessary ISS resources, e.g. power and intermodule ventilation (IMV), to 
support this mode of operation. 


3.1.4 Launch and Landing Probability/A vailability 
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3.1.4.1 Launch Availability 


The CTS shall have a launch probability not less than 80% for each launch opportunity, 
exclusive of external launch constraints and abort zone weather, for the time interval beginning 
with tanking and ending with the launch window close for that attempt. [R.CTS.022] [I] 


Rationale: The launch vehicle, spacecraft, and ground infrastructure must be designed to 
have a high launch probability once the vehicle is in the final stages of preparation for 
launch. Each point at which the ISS is within the planar and phasing capabilities of the 
system is considered a launch opportunity; therefore, probability must be calculated 
throughout the year for these daily opportunities. The timeframe begins with booster tanking 
on the launch day, which signals a commitment to launch on that day and ends when a 
launch is no longer possible due to performance limitations. 


Systems reliability, launch constraints, and CTS design-imposed weather constraints are 
driven by the CTS design, and must be included in the launch probability calculation. 
Examples include launch pad winds affecting tower clearance, the ability to fly through 
precipitation, and upper level winds. External constraints are conditions outside the 
Commercial Provider's control (reference Appendix B), and are not included in the launch 
probability calculation. 


3.1.4.2 Launch Recycle Time 


The CTS shall be ready to launch at the opening of the launch window on the calendar day 
following a missed initial launch attempt due to external launch constraints. [R.CTS.023] [I] 


Rationale: The launch vehicle, spacecraft, and ground infrastructure should be designed and 
sized to nominally launch on consecutive days in order to support nominal scheduling 
operations for the range. Additionally, resupply traffic considerations, crew rotation plans, 
and ISS operations require high schedule confidence for the arrival of the spacecraft at the 
ISS. External constraints are conditions outside the provider's control (reference Appendix 
B). The system should be able to recycle if the launch scrub was not due to the vehicle. The 
focus should be on recycle, not on repair. 


3.1.4.3 Launch Lighting 


The CTS shall launch the integrated space vehicle in all ambient lighting conditions. 
[R.CTS.024] 


Rationale: The launch time for a rendezvous with the ISS varies by 24 minutes each day, 
resulting in a dramatic change in the launch time over a two-week period. Use of night-time 
launch windows greatly increases the opportunities for launch to a successful rendezvous 
orbit. Approximately 40% of the launch opportunities to the ISS occur in darkness when 
assessed over a one-year period. Therefore, ambient lighting restrictions would severely 
impact the ability to launch on most days throughout the year, which is required to meet the 
overall ISS Program requirements. Even during daylight hours, some environmental 
conditions (i.e. fog, light rain, high humidity) can preclude visibility and should be taken into 
account. 


3.1.4.4 Landing Lighting 
The CTS shall perform landing in all ambient lighting conditions. [R.CTS.025] 
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Rationale: The capability to land in day or night lighting conditions will maximize landing 
opportunities, which is required due to the future ISS traffic models with resupply occurring 
from a multitude of vehicles. Additionally, for launch abort landings or for early mission 
termination, the lighting may be either daylight or dark. In order to maximize crew 
survivability, the CTS should be able to land in all lighting conditions. 


3.1.5 Onorbit 
3.1.5.1 RPOD Lighting 


The CTS shall perform rendezvous, proximity operations, docking (RPOD) and undocking 
independent of ambient lighting conditions and ground overflight constraints, to enable docking 
and undocking during 95% of the planned orbit. [R.CTS.026] [I] 


Rationale: The intent of this requirement is that ambient lighting or ground overflight 
constraints should not affect final rendezvous, proximity operations, docking or undocking 
operations, or normal ISS operations, in terms of crew timeline considerations or docking 
attitudes. 


This does not necessarily require that each navigation sensor be capable of operating in all 
lighting conditions. The CTS should not require proximity operations and docking to be 
aborted due to ambient lighting conditions. The trajectory and timeline should be forgiving 
enough to accommodate minor approach adjustments during brief periods of degraded 
navigation/crew visibility due to orbital lighting conditions, and allow docking and 
undocking operations to occur over a large portion of the planned orbit. 


Docking over a particular set of ground stations could limit docking to a very small 
allowable time period. This could overly constrain launch time or could require a significant 
wait time on orbit, particularly if a docking opportunity is missed. Docking independent of 
ground overflight constraints avoids these restrictions and added resource requirements. 


3.1.5.2 Relocate to Different Docking Port 


The spacecraft shall perform one relocation from the initial docking port to another available 
USOS docking port after the initial spacecraft docking to the ISS. [R.CTS.027] []] 


Rationale: The ISS configuration is expected to be dynamic in the foreseeable future, as the 
ISS will be required to manage heavy visiting vehicle traffic and accommodate exploration 
modules, new utilization experiments, etc. Providing port relocation capability allows the 
ISS to make late port utilization decisions, and in general, provides ISS visiting vehicle traffic 
operational flexibility thru end of life. Port relocations will be performed only on selected 
missions. Relocations are performed with full crew complement without using the station 
robotic arm. It is not necessary to protect consumables for port-to-port relocations. 


3.1.5.3 ISS Fly-around 


The spacecraft shall perform one complete fly-around at a range of less than 250 meters, as 
measured from spacecraft center of mass to ISS center of mass, after undocking from the ISS. 
[R.CTS.028] [1] 


Rationale: The ISS Program requires periodic inspections of portions of the ISS that are not 
visible from the ISS windows or from the external ISS cameras. In order for the spacecraft to 
execute the fly-around, the guidance, navigation, and control (GN&C), rendezvous sensors, 
propulsion, crew displays and controls, and other systems must be designed to provide for 
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this capability. However, consumables will not be reserved. The fly-around will only be 
executed on missions where sufficient consumables are available. The actual range of the fly- 
around will be determined jointly with NASA, based on the GN&C and propulsion on the 
spacecraft. Minimum safe distance for a fly-around will be determined in part by the 
trajectory and plume related requirements in the SSP 50808. The fly-around should occur as 
close to the ISS as possible, while meeting these requirements, at a range of less than 250 
meters and result in a 360 degree planar transit around the ISS. 250 meters was chosen as 
the upper limit based on considerations of increased propellant usage and decreasing flight 
crew camera imaging capabilities and is consistent with Space Shuttle fly-around experience. 


3.1.5.4 Support Photography during Fly-Around 


The spacecraft shall provide for crew photography of the ISS during a fly-around through an 
optically uniform window that meets or exceeds Category D optical properties per JSC 66320, 
Optical Property Requirements for Glasses, Ceramics, and Plastics in Spacecraft Window 
Systems. [R.CTS.384] [I] 


Rationale: The ISS Program requires images in support of the periodic inspections of 
portions of the ISS that are not visible from the ISS windows or from the external ISS 
cameras. In order to take these images with a NASA-provided hand-held camera, which is 
transported as flight crew equipment, the spacecraft needs a window that is accessible to a 
crewmember in the flight configuration that does not impede piloting tasks. In addition, the 
window must have sufficient optical quality that the photography can produce the necessary 
images required for anomaly resolution. 
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3.2. Safety and Mission Assurance 
3.2.1 Crew Safety 
3.2.1.1 Loss of Crew Risk 


The CTS shall safely execute the objectives defined in Section 3.1 with the following Loss of 
Crew (LOC) requirements for the various mission phases. 


a. The overall LOC probability distribution for an ISS mission shall have a mean value no 
greater than 1 in 200 without utilizing operational controls implemented by the ISS, such as 
TPS inspections. 


b. The LOC probability distribution for the combined ascent and entry phases of an ISS mission 
shall have a mean value no greater than 1 in 500. [R.CTS.030] 


Rationale: The LOC requirement is consistent with NASA's defined goals and thresholds for 
crewed vehicles. The LOC values are part of the overall certification process for the 
commercial launch vehicle and spacecraft and establish a basis for decision making relative 
to safety enhancing features in the design, including failure tolerance. The LOC requirement 
represents a design robustness criteria to be managed by the commercial provider alone. 


3.2.1.2 Loss of Mission Risk 


The CTS Loss of Mission (LOM) probability distribution for an ISS mission shall have a mean 
value of no greater than 1 in 55. [R.CTS.031] 


Rationale: The LOM requirement is consistent with NASA's defined goals and thresholds for 
crewed vehicles. LOM values are part of the overall certification process for the commercial 
launch vehicle and spacecraft and establish a basis for decision making relative to mission 
enhancing features in the design, including failure tolerance. 


3.2.1.3 Flight Element Stability 


The CTS flight elements shall be both stable and controllable for nominal and abort flight 
mission phases. [R.CTS.317] 


Rationale: Maintaining stability and control of the vehicle during all flight phases (ascent, 
abort, onorbit, entry, descent, and landing) is a fundamental safety requirement of human 
space flight. All control systems used for crewed flight must show stability and sufficient 
control authority during normal flight, dispersed conditions, and certain failure conditions. 
Passively controlled phases of flight, such as when on parachutes, must show stability. This 
also provides safety margin for flight to cover for inaccuracies in vehicle and environmental 
modeling. 


3.2.2 Safety and Hazard Control 
3.2.2.1 Monitor Controls and Inhibits 


The CTS shall monitor the status of controls and inhibits associated with functions whose 
inadvertent activation and those functions whose failure to activate when required could have 
catastrophic results. [R.CTS.033] 


Rationale: Controls are hardware and software features provided to mitigate (reduce the 
likelihood of) the cause of a catastrophic hazard. Inhibits are a special implementation of 
hazard controls for safety-critical functions, which disable the functions. Monitoring 
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controls and inhibits ensures they are functional and effective at all times. In addition, 
monitoring provides situational awareness of the state of the vehicle and the risks presented 
by a change in the status of these controls. This knowledge can support actions to move to a 
less hazardous state or inform decisions while operation in this state. 


3.2.2.2 Control Critical Hazards 
The CTS shall control critical hazards. [R.CTS.341] 


Rationale: A critical hazard is a condition that may cause a severe injury or occupational 
illness. Control of critical hazards ensures the health of the crew. 


3.2.3. Failure Tolerance 
3.2.3.1 Failure Tolerance to Catastrophic Events 


The CTS shall provide failure tolerance for the control of catastrophic hazards, with the specific 
level of failure tolerance (one or more) and implementation (the use of similar or dissimilar 
redundancy) derived from an analysis of hazards, failure modes, and risk associated with the 
system. 


a. The CTS shall provide dual failure tolerance or single failure tolerance with dissimilar 
redundancy for the control of catastrophic hazards in the systems that provide the guidance, 
navigation, and flight path/trajectory control functions for the deorbit burn, entry, and 
landing phases of the mission. 


b. Failure of primary structure, structural failure of pressure vessel walls, and failure of 
pressurized lines are excepted from the failure tolerance requirement, provided the 
potentially catastrophic failures are controlled through a defined process approved by NASA 
and in which standards and margins are implemented that account for the absence of failure 
tolerance. 


c. Failure of aerodynamic control effectors and parachutes are excepted from the dual failure 
tolerance requirement in sub-paragraph a., and are governed by the base requirement for one 
or more levels of failure tolerance as derived from an analysis of hazards, failure modes, and 
risk associated with the system. [R.CTS.034] 


Rationale: The overall objective is to provide the safest design that can accomplish the 
mission, given the constraints imposed on the Program. Since a CTS development will 
always have mass, volume, schedule, and cost constraints, choosing where and how to apply 
failure tolerance requires integrated analyses at the system level to assess safety and mission 
risks. First and foremost, the failure tolerance is applied at the overall system level to 
include all capabilities of the system (software, hardware, operations). While failure 
tolerance is a term frequently used to describe minimum acceptable redundancy, it may also 
be used to describe two similar systems, dissimilar systems, cross-strapping, or functional 
interrelationships that ensure minimally acceptable system performance despite failures, or 
additional features that completely mitigate the effects of failures. Even when assessing 
failure tolerance at the integrated system level, the increased complexity and the additional 
utilization of system resources (e.g., mass, power) required by a failure tolerant design may 
negatively impact overall system safety as the level of failure tolerance is increased. 


Ultimately, the level and type of redundancy (similar or dissimilar) is an important and often 
controversial aspect of system design. Since redundancy does not, by itself, make a system 
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safe, it is the responsibility of the engineering and safety teams to determine the safest 
practical system design given the mission requirements and constraints. Additionally, the 
overall system reliability is a significant element of the integrated safety and design analysis 
used in the determination of the level of redundancy. Redundancy alone without sufficient 
reliability does not meet the intent of this requirement. Catastrophic events, as defined in 
this document and consistent with NPR 8715.3, NASA General Safety Program 
Requirements, include crew fatality and the unplanned loss/destruction of a major element of 
the crewed space system during the mission that could potentially lead to death or permanent 
disability of the crew or passengers. 


Where failure tolerance is not the appropriate approach to control hazards, specific 
measures need to be employed to: 1) recognize the importance of the hazards being 
controlled, 2) ensure robustness of the design, and 3) ensure adequate attention/focus is 
being applied to the design, manufacture, implementation, test, analysis, and inspection of 
the items and/or software. Where the CTS cannot provide the minimum required failure 
tolerance to control a catastrophic hazard, NASA may grant an exception to the 
requirements provided: a) the analysis can quantify, with sufficient confidence, the risk delta 
associated with the reduction in failure tolerance, b) NASA determines the risk is acceptable, 
or Cc) the hazard is controlled through a defined process in which standards and margins are 
implemented that account for the reduced failure tolerance. 


3.2.3.2 Failure Tolerance without Aborts 


The CTS shall provide the failure tolerance to catastrophic events, required in requirement 
3.2.3.1, without the use of pad or ascent aborts or other emergency equipment and systems 
(emergency equipment and systems are defined in Section 3.2.5 of this document). 


a. Appropriate credit may be taken for pad or ascent aborts and other emergency equipment and 
systems for the LOC assessments (defined in Section 3.2.1 of this document.). [R.CTS.035] 


Rationale: Emergency systems and equipment, such as fire suppression systems, fire 
extinguishers, emergency breathing masks, launch/entry pressure suits, ballistic unguided 
entry capability, and ascent aborts, are not to be considered part of the failure tolerance 
capability. Emergency systems are there to mitigate the effects of a hazard, when the first 
line of defense, in the form of failure tolerance, cannot prevent the occurrence of the 
hazardous situation. Emergency systems may be used for LOC assessments even though 
some of these capabilities, such as aborts or ballistic entry, may return the crew to Earth 
someplace other than the nominal or backup landing locations and place the crew in a 
survival situation. 


3.2.3.3, Separation of Redundant Systems 


The CTS should separate or protect redundant systems, redundant subsystems, and redundant 
major elements of subsystems (such as assemblies, panels, power supplies, tanks, controls, and 
associated interconnecting wiring and fluid lines) to ensure that an unexpected event which 
damages one is not likely to prevent the other from performing the functions. [R.CTS.339] 


Rationale: Where redundancy is used to satisfy the failure tolerance requirement, this design 
guideline should be considered to provide maximum protection from common cause events. 
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3.2.3.4 Isolate and Recover from Faults 


The CTS shall isolate faults and recover lost functions that would result in a catastrophic event. 
[R.CTS.038] 


Rationale: A hazard analysis identifies the causes of hazards and the controls needed for 
these causes to assure safety. It is necessary to ensure the controls can be activated to 
isolate the fault and prevent further propagation of the hazard. Once the fault is isolated, 
critical functions must continue, which is protected for by the failure tolerance requirement. 
The isolation of faults cannot interfere with the implementation of failure tolerance. 


3.2.3.5 Failure Tolerance without Corrective Maintenance 


The CTS shall provide failure tolerance to catastrophic events, required in requirement 3.2.3.1, 
without the use of corrective maintenance. [R.CTS.125] 


Rationale: Where redundancy is required to satisfy failure tolerance requirements, the 
redundancy must be built into the spacecraft system and not rely on crew maintenance to 
replace a failed component or avionics unit. An additional component that is onboard the 
spacecraft but not designed to be a functional operating part of the system will not be 
allowed to be considered in order to meet the failure tolerance requirements. For example, 
two non-functional spare avionics boxes stowed onboard, but not connected to a system, 
cannot be used to declare a single failure tolerant subsystem to be three-failure tolerant. 


3.2.4 Health and Status 
3.2.4.1 Detect and Annunciate Faults 
The CTS shall detect and annunciate critical faults. [R.CTS.037] 


Rationale: A fault is defined as an undesired system state. A failure is an actual malfunction 
of a hardware or software item's intended function. The definition of the term "fault" 
envelopes the word "failure" since faults include other undesired events, such as software 
anomalies and operational anomalies. A critical fault would result in a catastrophic event or 
an abort. It is necessary to alert the crew to faults (not just failures) that affect critical 
functions. An alerting system decreases the cognitive load on the crew. Terminology, 
references, and graphics used are to be coordinated with other crew task demands so as to 
minimize additional training. 


3.2.4.2 Record and Display Health and Status 
The CTS shall generate health, status, and engineering data to be used as follows: 


a. Display health and status data onboard to the crew for nominal operations and flight anomaly 
resolution. 


b. Transmit health, status, and engineering data required for nominal operations, flight anomaly 
resolution, catastrophic event reconstruction and commit to flight decision making to the 
CVCC. 


c. When the vehicle is out of communication, record health, status, and engineering data 
onboard for later transmission. [R.CTS.040] 

Rationale: Access to spacecraft and launch vehicle health, status, and engineering data is a 

key element of command decision making and anomaly resolution during the mission. 

Making the data available to both the CVCC and crew could prevent the crew from executing 
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an abort or prevent a situation from developing into a catastrophic event. Post-flight, the 
data will be used to understand system performance and make further improvements to 
operation and safety, as well as inform future commit to flight decision making. The design 
optimization will establish how much data should be displayed, recorded, and transmitted 
and during which periods to support nominal operations, flight anomaly resolution, and 
catastrophic event reconstruction. Data transmitted during ISS docked operations is subject 
to requirements in SSP 50808. 


3.2.4.3 Flight Imagery 


The CTS shall provide motion and still imagery during critical mission phases to support 
performance assessment, anomaly resolution, and mishap investigation. [R.CTS.072] 


Rationale: During critical mission phases (i.e., major vehicle configuration or state 
changes), imagery provides a complementary means of assessing flight performance where 
instrumentation alone is insufficient to validate vehicle performance and hazard controls. 
Post-flight, the data will be used to understand system performance and make further 
improvements to operation and safety. The design optimization will establish how much 
vehicle imagery should be recorded and transmitted and during which periods to support 
operations, performance assessment, flight anomaly resolution, and mishap event 
reconstruction. Ground-based imagery of ascent may be limited to imagery obtained at the 
launch site. Downrange imagery can be obtained by utilizing airborne and/or maritime 
assets. Proximity operations imagery may be restricted to existing ISS camera assets. 
Imagery of descent and ground-based imagery of landing may be limited to nominal, pre- 
designated landing sites. This data, particularly time-synchronized imagery, has been an 
invaluable complement to other instrumentation when off-nominal events have occurred 
during flight. This requirement is not meant to imply 100% continuous imagery capture. 


3.2.4.4 Monitor Environments 


The CTS shall capture direct and indirect effects of natural and induced environments that could 
result in exceedances of the integrated space vehicle design limits prior to launch. [R.CTS.074] 


Rationale: The conditions that the launch vehicle and spacecraft are exposed to prior to 
launch must be assessed against the design environments used for certification and to 
support commit-to-flight decision making. These environments include atmospheric 
conditions (including lightning), handling/transport loads, interface loads, and other 
conditions that the vehicle is exposed to, which could invalidate design assumptions. 
Objective evidence will be needed to demonstrate that the flight hardware has been 
maintained within certification limits prior to launch. This data has been invaluable when 
off-nominal events have occurred prior to launch (e.g., extreme weather events, 
transportation mishaps, lifting mishaps). This requirement is not meant to imply 100% 
continuous data capture for all hardware prior to launch. The design optimization will 
establish how much data should be captured and during which periods where the hardware 
is at risk of being exposed to natural and induced environments that may exceed certification 
limits. 

3.2.4.5 Natural Environments 
The CTS shall establish and utilize a standard set of natural environment data and models. 
[R.CTS.382] 
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Rationale: Environments refers to all environmental factors appropriate to the CTS DRMs 
that influence the design or the function of flight systems. They consist of a variety of 
external environments (most of natural origin and a few of human origin), which impose 
restrictions or otherwise impact the development or operation of aerospace vehicles. 
Natural environments are outside the actual control of NASA and the Commercial Provider, 
so the Commercial Provider should control the risks and "definition" of these factors (i.é., 
the models, data sets, and descriptions) in order to maintain a uniform, consistent, and 
verifiable baseline for hardware development. 


3.2.5 Emergency Equipment 
3.2.5.1 Access Emergency Equipment 


The CTS shall provide crew access to equipment involved in the response to emergency 
situations in all flight phases without the use of tools and within the time required to respond to 
the hazard. [R.CTS.041] 


Rationale: Fire extinguishers are one example of the type of equipment needed for immediate 
response to a fire emergency. Crew access means that the crew inside the spacecraft is able 
to access the equipment in the time required, depending on the phase of flight and the time to 
effect of the hazard. Crew access also accounts for encumbered crewmembers if the 
equipment could be needed during a mission phase or operation where the crew is suited. A 
contamination clean-up kit is an example of equipment needed for follow up/recovery 
operations. 


Design requirements are to consider all emergency scenarios requiring access to equipment 
for emergency response and needed for follow-up/recovery actions. The location and 
proximity of emergency equipment to the crew will impact accessibility. Furthermore, each 
emergency may have a unique time requirement and, therefore, a different constraint on 
access. 


Due to the critical nature of the situation, time-critical and emergency equipment must 
permit crew access and operation without the use of tools to unstow or operate the 
equipment. 


3.2.5.2 Breathing Mask 


The spacecraft shall supply a breathing apparatus (mask) for all crewmembers whenever the 
cabin atmosphere may be contaminated and whenever an unplanned reduction in cabin pressure 
occurs. The apparatus shall: 


Protect the eyes and respiratory tract from a contaminated cabin atmosphere. 


b. Maintain breathing zone ppO2 and ppCO2 levels, defined in Table 3.10.11.1.1-1, for 
response to a contamination contingency until CO, HCN, and HCl has been re-established 
per table 3.10.11.1.3-1. 


c. Supply nominal 100% oxygen for a depressurization contingency until crewmembers are in 
fully functioning pressure suit. [R.CTS.042] 


Rationale: The intent of this requirement is to supply crew with breathing apparatuses that 
provide protection and breathing gases within established limits and to define duration for 
apparatus function. The two scenarios for which a breathing mask would be employed 

include a contaminated atmosphere due to fire or toxic release and an unplanned reduction 
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in cabin pressure. This requirement can be met with many different implementations 
involving one or more masks. 


For the contaminated atmosphere case, each crewmember will require delivery of 
uncontaminated and appropriate breathing gas in order to avoid crew performance impacts 
and allow for crew survival until concentrations of CO, HCN, and HCI have been re- 
established per Table 3.10.11.1.3-1. The timeframe for which masks are required is 
governed by the system that removes particulates from the cabin, including cabin purges 
and/or a filtering system. For the depress contingency, breathing apparatus must maintain 
100% oxygen delivery until each crewmember is in a fully functional pressure suit or is in a 
habitable environment. The timeframe for fully functional suit includes donning, buttoning 
up, flowing O2, and passing leak check. 


In the case that an unplanned reduction in cabin pressure occurs, the crew should be able to 
breathe 100% oxygen to reduce their risk of decompression sickness (DCS) and prevent 
hypoxia as the scenario unfolds. The operational decision on when to use 100% oxygen to 
mitigate DCS risk and prevent hypoxia may need to be weighed against fire risk if oxygen use 
results in increased cabin ppO2. 


3.2.5.3 Voice Communication in Breathing Apparatus 


The CTS shall provide voice communication between each of the crewmembers and the CVCC 
when wearing the contingency breathing apparatus in the spacecraft. [R.CTS.043] 


3.2.5.4 Emergency Lighting 


The CTS shall provide automatically activated emergency lighting for crew egress and 
operational recovery in accordance with Table 3.2.5.4-1. [R.CTS.044] 


Rationale: Emergency lighting is a part of the overall lighting system for all vehicles. It 
allows for crew egress and operational recovery in the event of a general power failure. 
Efficient transit includes appropriate orientation with respect to doorways and hatches, as 
well as obstacle avoidance along the egress path. The emergency lighting system may 
include unpowered illumination sources that provide markers or orientation cues for crew 
egress. Design guidance for emergency lighting can be found in NASA/SP-2010-3407, 
Human Integration Design Handbook (HIDH). 


Table 3.2.5.4-1: Emergency Lighting Intensity Levels 


Notes: 
(1) Levels are measured at the task object or 789 mm (30 in.) above floor, as 
applicable. 


(2) All levels are minimum. 
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3.2.5.5 Portable Fire Suppression 


The spacecraft shall contain a manually operated, portable fire suppression system accessible by 
the crew within 1 minute. [R.CTS.045] 


Rationale: The crew must have portable fire-fighting capability, even if a fixed fire-fighting 
system is provided in enclosed/solated areas in the pressurized crew cabin, in order to 
quickly extinguish fires in the crew cabin or in areas where the fixed system is ineffective. In 
pre-launch, post-landing, or docked scenarios the crew must be able to extinguish any fire 
that impedes egress. For enclosed/isolated areas with potential ignition sources, access ports 
allow fire suppression without removing access panels. Access panels provide some 
separation between the habitable crew cabin and fire, combustion products and suppressant 
in the enclosed area. See also 3.10.12.2 Use of Hazardous Chemicals. 


3.2.5.6 Personal Protective Equipment 


The spacecraft shall contain Personal Protective Equipment (PPE) for each crewmember in the 
event of an emergency. [R.CTS.046] 


Rationale: Space flight experience has shown that not all hazards, such as airborne toxic 
risks, can be completely controlled; therefore, the crew must have access to individual 
protective equipment in the event of failure of other controls. This equipment may include, 
but is not limited to, masks, goggles, gloves, eyewash, and contingency breathing apparatus 
as described in SSP 50653-1, Basic Provisions on Crew Actions in the Event of a Toxic 
Release on the ISS, Section 13.0, "Personal Protective Equipment." In an emergency, this 
equipment must be near-to-hand and quickly accessible. PPE is not to interfere with the 
crew's ability to conduct emergency operations, including communication between 
crewmembers and with ground personnel. Automation of protective equipment is to be 
provided for tasks the crew may not be able to perform under emergency or stressful 
conditions (for example, where the crewmember is distracted or disabled). 


3.2.5.7 Fire Detection and Suppression in Isolated Areas 


The spacecraft shall provide fire event detection and fire suppression systems for the spacecraft's 
enclosed/isolated areas in the pressurized volume where there is forced air flow and potential 
ignition sources or credible oxygen enrichment/leakage and potential ignition sources. 
[R.CTS.047] 


Rationale: This requirement is to provide fire event detection and fire suppression systems 
that are integrated into the spacecraft for enclosed/isolated areas in the pressurized crew 
volume to mitigate the hazardous effects of fires onboard the spacecraft. The type of fire 
event detection and fire suppression required will be a function of materials selection in 
conjunction with proximity to ignition sources and oxidizers. Enclosed/isolated areas that 
the crew cannot reach with a portable fire extinguisher should have a fixed fire suppression 
system. By definition, there is no risk of fire in enclosed area that does not contain a 
potential ignition source, such as stowage lockers for food, clothing, or other types of 
equipment lacking batteries or electrical connectivity to power sources. Such enclosed 
volumes lacking ignition sources do not require any provisions for fire event detection and 
suppression. A credible oxygen leak would be any single failure that could cause leakage of 
oxygen into an enclosed/isolated area. Leakage from pressurized lines, a welded connection, 
or amechanical fitting with a metal seal that will not be broken in-flight that has been proof 
and leak tested are normally acceptable. See also 3.10.12.2 Use of Hazardous Chemicals. 
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3.2.5.8 Locate Spacecraft after Landing 


The spacecraft shall provide its location to the recovery/rescue forces from landing until the 
recovery/rescue forces arrive. [R.CTS.089] 


Rationale: In the event of a contingency, the spacecraft may not land in the nominal pre- 
planned location. Experience has shown that the system must provide recovery/rescue teams 
with continuous information as to the spacecraft's location in a hatch-closed configuration 
until it is found and recovery/rescue teams can arrive to minimize placing the flight crew in a 
survival situation. 


3.2.5.9 Fire Detection in Habitable Cabin 
The spacecraft shall provide fire event detection in the crew habitable cabin. [R.CTS.349] 


Rationale: Since the spacecraft open cabin must provide air circulation for crew respiration, 
and since various types of in-cabin electrical equipment could provide an ignition source, the 
open or habitable cabin volume must have provision for fire event detection. Smoke detection 
will meet the intent of this requirement; however, other detectors such as Carbon Monoxide 
detectors, flame detectors, or other technologies could be demonstrated in a successful 
design. 


3.2.5.10Protection from Cabin Depressurization 


The CTS shall provide pressure suits as an emergency system to protect each individual 
crewmember from a depressurized cabin during ascent and entry. 


The pressure suit shall operate at a minimum pressure of 3.5 psia. 


b. The pressure suit shall provide nominal 100% O2 to prevent hypoxia and mitigate the risk of 
decompression sickness. 


c. The pressure suit shall limit ppCO2 to less than 5 mm Hg to mitigate the effects of 
hypercapnia. [R.CTS.048] 


Rationale: Pressure suits for each crewmember are required to protect the crew when a 
large cabin leak causes depressurization to 0 psia. Both U.S. and Russian human space 
flight experience has demonstrated that the ascent/entry timeframe is highest risk period for 
catastrophic failures. The conversion of energy during these timeframes using the processes, 
materials, and structural factors of safety place the crew at a much greater risk during these 
flight phases. For these reasons and given the hazard time to effect, the crewmembers will 
wear pressure suits during ascent and entry. Pressure suits will protect the crew from the 
low pressure cabin environment and allow the crew to take advantage of the spacecraft 
operability that exists below certified limits to return the crew to Earth. For short term 
operations in a spacesuit, the crew needs to be protected against hypoxia and decompression 
sickness. This requirement does not preclude the crew docking with the ISS in an emergency. 


3.2.5.11 Pressure Suits 


The following are requirements that define capabilities and/or functions needed in a pressure 
suit. A pressure suit is a system which provides a safe, habitable environment to each 
crewmember in the event of a rapid cabin depressurization during ascent or entry, a cabin leak 
with a subsequent failure of the cabin pressure maintenance system, or a cabin leak and as part of 
an alternative crew survival strategy. The pressure suit provides an environment for sufficient 
duration to assess the leak and return the crew safely to Earth. 
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3.2.5.11.1 Suited Habitable Duration 


The CTS shall provide sufficient consumables to sustain life of the pressure suited crew in a 
depressurized cabin for the following conditions: 


a. For the time it takes to perform deorbit, entry, and landing of the vehicle. 


b. An ascent abort at any point along the trajectory. [R.CTS.322] 


Rationale: In the event that the vehicle loses its ability to maintain pressure, the crew needs 
to be protected until they are safely returned to the surface of the Earth. Sufficient 
consumables are needed for the crew to safely land following an abort or deorbit, entry, and 
landing after a loss of cabin pressure. 


3.2.5.11.2 Donning during Leak 
The suit shall provide for unassisted suit donning and connection to life support. [R.CTS.324] 


Rationale: The intent of this requirement is to ensure that the suit design readily enables 
donning and connection to life support without assistance by a trained crewmember in order 
to streamline operational timelines. In addition, unassisted don capability is required in 
cases whereby other flight crewmembers are unavailable to assist, either because they are 
incapacitated or physically cannot provide assistance. The risk of a crewmember having to 
perform an unassisted suit donning in a contingency is significantly mitigated since the crew 
are required to wear their suits during ascent and entry. This risk is also mitigated by the 
requirement for the spacecraft cabin to maintain a pressure of no less than 55.2 kPa (8.0 
psia) for the time required to execute a deorbit and landing in the event of a cabin leak. 


3.2.5.11.3 Suit Communications 


The suit shall provide two-way voice communications between each of the crewmembers and the 
CVCC. [R.CTS.328] 


Rationale: When the crew is suited, they will not be able to hear each other. Additionally, 
the vehicle audio speakers will not be heard/intelligible, particularly in a vacuum. In these 
cases, the suit must allow for communication between crewmembers and between the crew 
and the CVCC. 


3.2.5.11.4 Body Waste Management in Suit 


The suit shall provide for the capability to contain urine and feces throughout suited operations. 
[R.CTS.332] 


Rationale: The suit must allow for a diaper or other simple system to contain bodily waste. 
3.2.5.11.5 Suit Accommodation of Metabolic Loads 


The suit shall accommodate crew metabolic loads provided in Appendix F - Metabolic Loads 
during all flight phases while maintaining a core body temperature between 97 °F and 100.5 °F. 
[R.CTS.388] 


Rationale: Metabolic loads, in conjunction with the operational concept, provide an upper 
bound for oxygen (O2) demand, carbon dioxide (CO2) production and heat rejection 
requirements. This information is vital for space suits design. The performance focuses on 
cooling effectiveness, because core body temperature regulation is critically important to 
prevent heat-related illnesses. Appendix F provides a short description of the data provided 


along with the assumptions used in the analysis. Guidance on the use of metabolic load data 
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in the design process can be found in Section 4.11 of JSC 65995. Heat load (increased core 
temperature and the consequent skin vasodilation) can exacerbate orthostatic intolerance. 
Therefore, the requirement for a mechanism to control body temperature during re-entry, 
landing, and post-landing within acceptable limits is tightly coupled with the requirements to 
provide protection against orthostatic intolerance (compression garments). Protection 
against orthostatic intolerance includes three major elements: lower body compression 
garments, fluid loading, and suit dissipation of metabolic heat loads. 


3.2.5.12 Unassisted Vehicle Egress 


The CTS shall provide for unassisted egress of the entire crew from the spacecraft within 90 
seconds from the decision to egress in both the pre-launch and post-landing flight configurations. 
[R.CTS.087] [I] 


Rationale: The entire crew must be able to egress the spacecraft to the launch platform or 
post-landing surface in the event contingencies occur during the pre-launch or the post- 
landing timeframe. This requirement assumes the crew is able to function in a 1-g 
environment. Unassisted means without help from ground or rescue personnel or equipment 
and in the planned configuration for launch and entry in terms of clothing or any special 
protective equipment, such as a pressure suit. Due to the deconditioned state of the crew 
after being onorbit for a period of 180 days, the crew will be unable to quickly doff any 
clothing or protective equipment prior to egress. In fact, in a deconditioned state, the crew 
may actually require assistance to egress the spacecraft; therefore, a wide range of 
accommodations such as mobility aids must be planned for landing. 


3.2.6 Software 
3.2.6.1 Manually Override Software 


The integrated space vehicle shall enable the crew to manually override higher level software 
control/automation (such as automated abort initiation, configuration change, and mode change) 
during pre-launch operations and ascent when the override of the software system will not 
directly cause a catastrophic event. [R.CTS.050] 


Rationale: This is a specific capability necessary for the crew to control the integrated space 
vehicle and ensure crew survival. The critical nature of software control and automation at 
the highest system level dictates this as a requirement flowed down from the NPR 8705.2B, 
NASA Human-Rating Requirements for Space Systems, Section 3.3.2; therefore, the crew 
must have the capability to control automated configuration changes and mode changes, 
including inhibiting automated aborts at the system level, as long as an override of the 
software system is feasible and will not directly cause a catastrophic event. 


3.2.6.2, Manually Override Software - Post-Separation 


The spacecraft shall enable the crew to manually override higher level software 
control/automation (such as automated abort initiation, configuration change, and mode change) 
during all mission phases post launch vehicle separation, including ISS integrated operations and 
while docked to the ISS, when the override of the software system will not directly cause a 
catastrophic event. [R.CTS.370] 

Rationale: This is a specific capability necessary for the crew to control the spacecraft and 
ensure crew survival. The critical nature of software control and automation at the highest 
system level dictates this as a requirement flowed down from the NPR 8705.2B, Section 
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3.3.2; therefore, the crew must have the capability to control automated configuration 
changes and mode changes, including inhibiting automated aborts at the system level, as 
long as an override of the software system is feasible and will not directly cause a 
catastrophic event. 


3.2.6.3 Autonomous Operation of System 


The integrated space vehicle shall autonomously operate critical system and subsystem 
functions. [R.CTS.051] 


Rationale: This capability means that the spacecraft does not depend on communication with 
ground personnel to perform functions that are required to keep the crew alive and return 
the crew safely. The intent of this requirement is for crewed integrated space vehicles only, 
and not to drive an uncrewed capability. 
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3.3. Pre-Launch/Ascent 
3.3.1 Pad and Ascent Aborts 
3.3.1.1 Detect and Initiate Abort 


The integrated space vehicle shall detect and automatically initiate a pad and ascent abort when 
immediate abort is the only method of crew survival prior to nominal spacecraft separation from 
launch vehicle. [R.CTS.057] 


Rationale: The primary emphasis of this capability is focused on launch vehicle failures 
where an immediate safe separation and return of the spacecraft will provide a chance for 
crew survival. However, spacecraft system failure modes must also be assessed to determine 
if the immediate response of an automated abort is necessary to save the crew as opposed to 
a manually initiated abort. Not all potentially catastrophic failures can be detected prior to 
manifestation. Similarly, system design and analysis cannot guarantee the crew will survive 
all catastrophic failures of the launch system, but the abort system should provide the best 
possible chance for the crew to survive. When an imminent catastrophic failure of the launch 
vehicle is detected, the time to effect requires the abort system to be initiated automatically. 
Also, if the catastrophic failure itself is detected by a monitoring system, the abort is initiated 
automatically. This is not intended to require independent implementation by the spacecraft 
of capabilities inherent to the launch vehicle. 


3.3.1.2 Determine Abort Mode 


The spacecraft shall automatically and autonomously determine the mode for an abort. 
[R.CTS.056] 


Rationale: For many abort scenarios, the timeframe between the initiating event (engine, 
thrust vector control, or other significant failure) and the resulting catastrophic event is so 
short that a human cannot react quickly enough to prevent the loss of the crew. The 
dynamics of the separation event may result in temporary loss of communications with the 
CVCC; therefore, an automated system is needed onboard the spacecraft to determine the 
appropriate abort mode. 


3.3.1.3 Pad Abort 


The CTS shall provide pad abort capability to protect the crew from a hazardous condition on the 
launch pad with a 95% probability of success with at least 90% confidence. [R.CTS.055] 


Rationale: During the final phase of the launch countdown when the crew has been secured 
in the vehicle, hazardous situations can arise which require the spacecraft to be quickly 
separated from the launch vehicle to protect the crew from imminent danger. For example, a 
launch vehicle propellant leak, impending explosion, or other hazardous situation may 
require the crew to utilize the pad abort capability to separate the spacecraft from the launch 
vehicle in a manner that allows a landing at a distance from the pad that protects the crew 
from the hazard. In order to protect the crew, the system must consider a wide range of 
hazardous situations, including an explosion of the launch vehicle. 


3.3.1.4 Ascent Abort 


The CTS shall provide continuous autonomous launch abort capability from lift-off through 
orbital insertion with a 95% probability of success with at least 90% confidence in the event of a 
loss of thrust or loss of attitude control. [R.CTS.058] 
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Rationale: Flying a spacecraft through the atmosphere to orbit entails inherent risk. 
Analysis, studies, and past experience all provide data supporting ascent abort as the best 
option for the crew to survive a failure of the launch vehicle. This does not cover assessment 
of catastrophic conditions assessed by the LOC analysis in requirement 3.2.1.1. These abort 
performance parameters will include, at a minimum, aborting spacecraft controllability, 
accelerating away (separating) from the launch vehicle without relying upon the 
aerodynamic deceleration of the launch vehicle, near-field re-contact with the launch 
vehicle, hardware thermal constraints, human g-load constraints, structural loads limits, and 
ability to achieve acceptable landing hardware criteria. In order to provide an effective 
system, the ascent abort capability must incorporate some type of vehicle monitoring to 
detect failures and, in some cases, impending failures. This requirement is in addition to the 
failure tolerance requirements in 3.2.3.1 and 3.2.3.2. 


3.3.1.5 Ascent Abort Reliability 


The CTS shall provide a pad and ascent abort system reliability of not less than 0.995 when an 
abort is initiated. [R.CTS.059] 


Rationale: The intent of this requirement is to design and develop a very robust abort system 
with high reliability of effective operation (1 failure in 200) when the system is activated. 
This requirement drives the system design such that the system will activate and function 
when needed to separate the crewed spacecraft from the launch vehicle. The scope of this 
requirement includes failure of the abort system to ignite and separate the spacecraft from 
the launch vehicle, failure to provide required thrust during the boost phase, and failure to 
separate from the spacecraft following the abort, if required. It is one of the inputs into the 
assessment of crew survivability once an abort is executed, which is determined by an 
integrated calculation of LOC/LOM. 


3.3.1.6 RESERVED 
3.3.1.7 Aborts outside DAEZ 


The CTS shall provide ascent aborts that result in the spacecraft landing outside the Downrange 
Abort Exclusion Zone (DAEZ). [R.CTS.061] 


Rationale: The DAEZ is a geographical area to be avoided for landings following launch 
aborts due to rough seas and cold water temperature in the North Atlantic. Additionally, 
landing within close proximity to land masses with pre-positioned recovery teams maximizes 
the probability of crew survival. 


3.3.1.8 Abort without Launch Vehicle Thrust 


The CTS shall perform pad and ascent aborts that separate the spacecraft from the launch vehicle 
without relying on thrust from the launch vehicle. [R.CTS.062] 


Rationale: Because the health of the launch vehicle cannot be guaranteed for abort 
situations, the spacecraft must be able to safely separate and perform ascent aborts without 
thrust from the launch vehicle. This does not preclude the operational use of the launch 
vehicle if available and desired to improve abort conditions when the launch vehicle is 
operating nominally. 
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3.3.1.9 Abort on Flight Termination System Command 


If a range safety destruct system is incorporated into the design, the integrated space vehicle shall 
automatically initiate an ascent abort sequence when range safety destruct commands are 
received onboard, with an adequate time delay prior to destruction of the launch vehicle to allow 
a successful abort, regardless of abort system inhibits. [R.CTS.063] 


Rationale: Prior to destruction of the launch vehicle, the abort system is automatically 
initiated. An automated initiation of the abort sequence provides the best chance for crew 
survival while protecting the public from a Range Safety violation. Note: The time delay will 
need to be negotiated with the appropriate Range Safety Authority. 


3.3.1.10 Initiate Pad and Ascent Abort 


Both the crew and the CVCC shall be capable of independently initiating the pad and the ascent 
abort sequence. [R.CTS.064] 


Rationale: Both the crew and flight controllers in the CVCC will likely have access to more 
data than an automated abort system. This functionality may be utilized for non-time-critical 
abort/contingency decision making or abort scenarios beyond the capability of the 
automated system; therefore, both the crew and the flight control team will have the 
capability to initiate the abort when necessary for crew survival. 


3.3.2 Emergency Pad Egress 
3.3.2.1 Detect Emergency Pad Egress 


The CTS shall detect and alert the CVCC of conditions requiring an emergency pad egress. 
[R.CTS.065] 


Rationale: The intent of this requirement is for the launch pad, spacecraft, and launch 
vehicle to be able to detect hazardous conditions, such as explosive hazards caused by 
propellant leaks, exterior fires, or significant systems failures in the launch vehicle, 
spacecraft, or launch pad infrastructure that threaten the safety of the crew. Detectors may 
include infrared sensors, UV fire detectors, high resolution video, hazardous gas detection 
systems, etc., to augment telemetry data provided by the launch vehicle, spacecraft, and pad 
GSE. This data is passed to the CVCC so that the appropriate leadership of the 
flight/ground control team can assess the danger and make a decision to egress the ground 
and flight crew, if required. 


3.3.2.2. Ground and Flight Crew Emergency Pad Egress 


The CTS shall provide emergency egress for all required ground crew and the flight crew on the 
launch support structure ending at a pre-coordinated collection point outside the blast danger 
area during pre-launch activities. Emergency egress will be based on the time required to 
respond to the hazard and does not preclude an intermediate stop at a designated safe location 
within the blast danger area. [R.CTS.066] 


Rationale: For contingency situations, where additional ground crew is not immediately 
available in the white room to assist, all flight crew plus the ground crew involved in crew 
strap-in and hatch closure will need the capability to evacuate the launch pad for safety 
reasons. This requirement can work in conjunction with requirement 3.2.5.12, which ensures 
that the crew can egress the spacecraft unassisted or 3.5.1.2 which provides for assisted 
vehicle egress. This requirement should drive design of the launch structure, spacecraft 
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access platforms/arms, launch structure emergency safety systems, and evacuation routes in 
the pre-launch orientation, pad perimeter access gates, and transportation to a pre- 
coordinated collection point to allow the ground and suited flight crew to egress without 
external ground crew assistance. In some cases, the emergency egress plan may include a 
stop at a designated safe location inside the blast danger area until an imminent hazard has 
been resolved. The pre-coordinated collection point is a location outside of the blast danger 
area where medical stabilization can occur and should be based on direction of the 
downwind corridor created by the hazard on launch day. NASA will perform medical 
stabilization and transportation from the pre-coordinated collection point to a Definitive 
Medical Care Facility (DMCF). 


3.3.3 Range Safety 
3.3.3.1 Alert Crew of Flight Termination 


The integrated space vehicle shall alert the crew upon receipt of arm and destruct Flight 
Termination System (FTS) command. [R.CTS.069] 


Rationale: If flight termination is required for the launch vehicle, an ascent abort separating 
the spacecraft from the explosion hazard will automatically occur. This requirement 
provides for an indication to the crew that the FTS command has been sent and an immediate 
ascent abort is about to transpire. 


3.3.3.2 Range Safety Program Compliance 


The CTS shall meet NPR 8715.5A, Range Flight Safety Program. [R.CTS.350] 


Rationale: NPR 8715.5A identifies the requirements to be placed on NASA programs, 
projects, and centers for the protection of the general public, workforce, and assets during 
vehicle flight activities. While mostly a responsibilities and process requirements document, 
it does contain a number of design driving requirements that must be met. It should be noted 
that the NPR is tailorable by NASA and also provides a waiver process in the event that 
requirements cannot be met or where an equivalent level of safety cannot be achieved. In 
addition, other range-specific safety requirements, such as AFSPCMAN 91-710, may apply 
and will be satisfied to that Authority. This NPR contains requirements that apply to U.S. 
commercial space vehicles and foreign space vehicles when carrying a NASA payload and/or 
NASA astronauts and the operation is not conducted under a Federal Aviation 
Administration (FAA) commercial launch operator license or foreign government 
range/public safety authority. This NPR does not apply if an operation is conducted under 
an FAA license or under foreign government range/public safety authority, unless specified 
by the applicable contract or agreement. 


3.3.4 Launch Support System 
3.3.4.1 Protection from Lightning 


The CTS shall prevent direct attachment of lightning to the integrated space vehicle while on the 
ground with 95% or greater probability of success with 90% confidence. [R.CTS.073] 


Rationale: The effects of lightning strikes on the launch vehicle and spacecraft can be 
mitigated with appropriate operational plans and design techniques. 
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3.3.4.2 Accommodate NASA Personnel at CVCC 


The CTS shall accommodate 4 mission essential NASA personnel at the CVCC with capability 
to monitor the pre-launch and mission operations activities and communicate with NASA 
personnel in ISS MCC-H. [R.CTS.071] [I] 


Rationale: Consoles, IT support, communication (including voice loops), displays, telemetry, 
etc., for monitoring pre-launch and mission operations at the CVCC are essential for NASA 
personnel participating in the agreed-to decision making process for commit to launch and 
monitoring real-time mission operations. The 4 NASA personnel will include a Program 
representative, a flight surgeon, and representatives from crew, mission operations, or other 
technical support. 
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3.4 Onorbit 
3.4.1 Contingency 
3.4.1.1 Emergency Return from ISS 


The CTS shall provide emergency return of all CTS-delivered crewmembers from the ISS within 
24 hours from the time that the decision to return has been made. [R.CTS.106] [I] 


Rationale: Emergency return can be invoked in the event of an ISS or medical emergency. 
Depending on the emergency, the return may require a targeted landing to facilitate rescue. 
The 24 hours provide an aspect of global coverage under the ground track to enable optimal 
flight performance for return to a landing site, and may enable expedited rescue when 
necessary. In the event of a declared emergency return, all crewmembers that arrived on the 
spacecraft must return with it so that they do not lose assured return capability after vehicle 
departure. In the case of a medical return, medical assets required to support an ill or 
injured crewmember's return will displace nominal payload, as necessary. For the purposes 
of this requirement, deorbit waive-off requirements (3.4.2.4 and 3.4.2.6) are not applicable. 


3.4.1.2 Undock without ISS Services 


The spacecraft shall perform all undocking and separation operations without services from the 
ISS. [R.CTS.076] [I] 


Rationale: For contingency undocking, the ISS may be unable to provide navigation data, 
attitude data, range/range rate data, or ISS power to the spacecraft; therefore, the spacecraft 
must be self-sufficient to complete the undocking and associated separation tasks. The 
driving scenarios are likely a decision to undock during a safe haven or in the event of loss of 
service for 24 hours to the spacecraft. 


3.4.1.3 Autonomous Deorbit 


The spacecraft shall have the capability to autonomously target and perform a deorbit, entry, and 
landing from orbital insertion through end of mission in the event of early mission termination. 
[R.CTS.086] 


Rationale: The crew should be able to terminate the mission with no assistance from the 
CVCC allowing a return to earth. This is a complementary requirement to requirement 
3.3.1.4, which ensures ascent abort autonomous operation and return. This requirement 
covers scenarios that could cause an early mission termination beginning with orbital 
insertion. 


3.4.2 Spacecraft Operations and Durations 


The total system endurance is to be specified by the CTS Provider and is dependent upon 
rendezvous and landing strategies; however, the requirements in this section drive the endurance 
by protecting for operations that ensure adequate margin for resolving issues. A notional 
endurance timeline can be found in Appendix P for reference. 


3.4.2.1 Docking 24 hours after Launch 


The spacecraft shall dock with the ISS 24 hours after launch while supporting a 190 degree 
rendezvous phase window. [R.CTS.078] [I] 


Rationale: Allowing for docking 24 hours after launch provides for a launch availability of at 


least 6 acceptable launch opportunities in 14 days due to phasing. This is based on an 
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assumed timeline utilizing 19 hours for phasing and 5 hours for fixed operations (ascent 
through orbital insertion and terminal rendezvous) along with 185 km (100 nm) delta 
altitude variations, which provides 190 degrees of phasing. The CTS may provide additional 
time beyond the 24 hours timeframe for rendezvous phasing in order to increase launch 
availability. On a mission-by-mission basis, docking times may occur earlier than 24 hours 
after launch, provided the crew work/rest related requirements are met in Section 3.10.10. 


3.4.2.2, Multiple Approach Attempts 


The spacecraft shall maneuver to an operationally-safe standoff distance after a recoverable 
docking failure on the initial attempt and perform an additional approach and docking attempt 90 
minutes after the initial attempt. [R.CTS.079] [I] 


Rationale: In the event that the ISS or CTS suffers a failure that delays nominal docking or if 
there is a recoverable failure onboard the spacecraft, consumables and vehicle capability 
should allow a back-out to a safe distance followed by another docking attempt 90 minutes 
later. On a mission-specific basis, the time of the additional docking attempt will be selected 
to match the failure scenario. For this requirement, 90 minutes was selected as 
representative of time to troubleshoot and reconfigure to clear the failure. Additionally, 90 
minutes is approximately the orbital period of ISS, so lighting and some communication 
availability will repeat. 


3.4.2.3 Support Docking Delay 


The spacecraft shall retreat to a safe distance after a second failed docking attempt and perform a 
final re-rendezvous, final approach, and docking attempt 24 hours after the initial attempt. 
[R.CTS.080] [1] 


Rationale: In the event that the second docking attempt occurring on the nominal docking 
crew day fails, consumables should allow a break-out to a safe distance followed by a re- 
rendezvous and docking on the next crew day. 


3.4.2.4 Support Deorbit Delay 


The spacecraft shall delay the deorbit maneuver by a minimum of 24 hours from the planned 
deorbit ignition time after the first missed deorbit attempt. [R.CTS.081] 


Rationale: Consumables are used to protect for scenarios requiring waive-offs at deorbit due 
to landing site issues (e.g., Range goes "red", unanticipated wind gusts, etc.) or spacecraft 
configuration issues. It also provides some protection for extended delays due to significant 
systems problems, allowing time for the flight control team to understand the problem and 
arrive at the best entry configuration. This capability must be preserved at all times during 
the mission until the deorbit maneuver time. See requirement 3.4.2.6 for associated backup 
landing site requirement. 


If the end-of-mission (EOM) is designed for ascending passes to the continental U.S., 24 
hours allows for subsequently transitioning to ascending passes in the same general area or 
landing off the coast of California. To the maximum extent possible, crew sleep periods 
should be uninterrupted and maintained on a stable schedule to avoid performance 
decrements related to circadian desynchrony and/or sleep deficit. 


Note that if a 24 hour contingency re-rendezvous or safe haven capability is not performed, 
those consumables can be used to extend the deorbit delay capability beyond that specified in 
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this requirement to enhance anomaly investigation time and improve landing opportunities 
from a crew scheduling viewpoint. 


3.4.2.5 ISS Safe Haven 


The spacecraft shall provide for a hatch-closed safe haven capability while docked to the ISS for 
all crewmembers returning with the spacecraft: 


a. For up to 6 hours on internal spacecraft power, and 


b. For up to an additional 18 hours if ISS power is restored to the spacecraft and rendezvous 
contingency consumables were not previously used. [R.CTS.082] [I] 


Rationale: The spacecraft must provide a safe haven for an emergency requiring ISS 
evacuation, starting with the spacecraft in its nominal ISS quiescent docked configuration. It 
is assumed that the ISS will be capable of maintaining attitude control for this contingency, 
so the assumption for safe haven is that the ISS will be in the normal planned attitude. In 
order to support a habitable environment for all the crewmembers transported to the ISS in 
the spacecraft, the life support system will need to be functional in sufficient time to maintain 
the cabin within contingency limits upon sudden crew ingress and hatch closure. The 
spacecraft must provide life support (O2, N2, CO2 removal, water, food, vehicle cooling, 
etc.) and power for 6 hours accounting for the metabolic rate of the crew. But it is possible 
that the emergency scenario could result in loss of power to the spacecraft. The 6 hours 
supports short time safe haven scenarios, such as sheltering in-place for orbital debris 
conjunctions. The 6 hours of safe haven contingency also provide time to address the ISS 
emergency, attempt to restore power to the spacecraft, and to determine if it is safe for crew 
to re-ingress the ISS. If the ISS is able to restore its power feed to the spacecraft and the 
consumables were not used to support a docking failure, the spacecraft should be able to 
extend the safe haven to a full 24 hours. See SSP 50808, 3.2.2.4.1.3 for ISS power provisions 
to the spacecraft. In the event of a fire, an attempt to recondition the ISS atmosphere will be 
made during this time. Requirement 3.10.11.1.3 describes a spacecraft purge capability if 
required for this contingency. 


3.4.2.6 Alternate Landing Site 
The CTS shall provide an alternate landing site to support a deorbit delay. [R.CTS.337] 


Rationale: The alternate landing site is a supported landing site other than the designated 
primary landing site, but not an emergency landing site. This protects for scenarios due to 
nominal landing site issues (e.g., Range goes "red", unanticipated wind gusts, etc.) or 
spacecraft configuration issues near the time of deorbit. 


3.4.2.7 Return after Failure to Dock 


The spacecraft shall return to a supported landing site after a 24 hour docking delay and final 
failed docking. [R.CTS.338] 


Rationale: After the final docking attempt required in requirement 3.4.2.3, the spacecraft 
needs sufficient consumables to target either a nominal designated landing site or a 
supported alternate landing site. This does not preclude a water landing with staged crew 
recovery assets. The intent is to not put the crew into a survival situation for recovery for 
this LOM scenario. To the maximum extent possible, crew sleep periods should be 
uninterrupted and maintained on a stable schedule to avoid performance decrements related 
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to circadian desynchrony and/or sleep deficit. Satisfying this requirement may suggest 
deorbit and landing on the following crew day. 


3.4.2.8 Integrated System Performance with Final Successful Rendezvous 


The spacecraft shall provide the integrated system performance required to complete a mission in 
which the nominal and contingency operations specified in requirements 3.4.2.1, 3.4.2.2, 3.4.2.3, 
3.4.2.4, 3.4.2.5, 3.4.2.6, and SSP 50808, Section 3.3.11.1.5 occur within the same mission. 
[R.CTS.375] 


Rationale: This stressing design mission represents the set of known operational 
contingencies that, when protected for, presents a reasonable risk posture for mission 
success. This mission scenario includes a second docking attempt on the nominal docking 
day, contingency rendezvous, safe haven, safe without services, and deorbit waive-off. Each 
of these situations by themselves presents unique challenges, but the full complement must be 
protected serially so that the CTS will have the reserve necessary to proceed should a 
problem be encountered. ISS will provide supplemental power for 48 hours after a 
contingency mating per SSP 50808. Although a safe haven or safe without services event per 
SSP 50808 could occur during this window, the CTS is not being required to fully support 
these contingencies during this timeframe due to the low probability of occurrence. 
Individual requirements in Section 3.4.2 are verified independently, whereas this 
requirement is verified as a complete mission Set. 


3.4.3. Orbital Debris 
3.4.3.1 Expendable Module Disposal 
The CTS shall meet NASA-STD-8719.14, Process for Limiting Orbital Debris. [R.CTS.083] 


Rationale: Man-made orbital debris is one of the top hazards for human space flight in terms 
of the LOC risk; therefore, it is NASA's policy, in cooperation with other space faring 
nations, to dispose of expendable modules and other orbital debris to avoid catastrophic 
damage to other crewed and uncrewed spacecraft. 


3.4.3.2 Collision Avoidance 


The CTS shall perform collision avoidance with trackable orbital debris during the pre-launch 
timeframe and during onorbit free-flight operations. 


Note: Docked collision avoidance will be handled by the MCC-H ISS flight control team. 
[R.CTS.084] 


Rationale: The intent of this requirement is to have the CTS protect the crew from collision 
with trackable orbital objects. Prior to launch, the predicted insertion and early operations 
trajectory will be screened against conjunctions and if a high risk event is identified the 
launch can be delayed. While onorbit, a translational maneuver is required when the risk to 
the crew exceeds a predefined threshold. NASA has a well-established process for 
identifying conjunctions and will do so for the commercial crew vehicle using the Probability 
of Collision (Pc) method to identify high risk conjunctions since it allows high risk events to 
be mitigated without causing unnecessary launch cutouts or maneuvers. 
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3.5 Entry/Landing Requirements 
3.5.1 Nominal 
3.5.1.1 RESERVED 
3.5.1.2 Assisted Vehicle Egress 
The CTS shall provide for assisted vehicle egress. [R.CTS.344] 


Rationale: In a post-landing deconditioned state or in a pre-launch or pad abort 
contingency, the crew may require assistance to egress the spacecraft. If the crew is 
incapacitated or deconditioned, the recovery/rescue team may be required to extract the 
crew; therefore, accommodations, such as mobility aids and external hatch controls for 
recovery/rescue personnel, must be planned for at landing and pre-launch. 


3.5.1.3 Visual Aids for Search and Rescue/Recovery 


The spacecraft shall provide visual aids for search and rescue/recovery in all ambient lighting 
conditions. [R.CTS.088] 


Rationale: Visual aids (e.g., flashing light beacons and dye bags) are necessary in 
rescue/recovery operations in all ambient lighting conditions to facilitate locating the vehicle 
and crew. The visual landing aids should be designed to operate in all lighting conditions, 
since the vehicle will be capable of landing in all ambient lighting conditions. Additionally, 
the system should be operable in all the weather conditions (wind, rain, ceiling, sea state, 
etc.) that the vehicle has been designed to land in. This system should include multiple 
methods to aid the search and rescue/recovery forces in locating the spacecraft. Examples 
include flashing light beacons/strobe lights, visual markers such as sea dye or smoke, along 
with high color contrast of portions of the spacecraft such as parachutes, uprighting bags, or 
special paint markings. 


3.5.1.4 Post-Landing Crew Services 


The CTS shall provide the post-landing services of drinking water (immediately accessible by 
the crew in their landing configuration), breathable atmosphere per 3.10.11.1.1 b,d, and cooling 
per 3.2.5.11.5 for the crew, for 2 hours after landing at a supported site. [R.CTS.090] 


Rationale: If the crew is deconditioned and is physically unable to egress the spacecraft, then 
the spacecraft provides a habitable environment until the arrival of the recovery team. The 
nominal end-of-mission entry will have well established timelines and expectations for the 
habitation conditions inside the spacecraft. The time requirement for recovery team to 
recover the crew at a supported landing site is approximately I hour. The provision of 2 
hours of post-landing services would provide some additional margin, and can be met with a 
combination of spacecraft and ground servicing equipment located at the supported landing 
sites. During the recovery phase, the crew is expected to remain in their seats under nominal 
conditions due to their deconditioned state with minimal tasking. 


3.5.1.5 Orthostatic Protection 


The CTS shall provide orthostatic protection to the crewmember with a lower body compression 
garment from the ankle to the top of the waist, which is considered the part of the abdomen 
between the bottom of the ribcage and the hips. The minimum pressure applied shall be 40 
mmHg and the maximum pressure applied shall be 80 mmHg. [R.CTS.091] 
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Rationale: Orthostatic intolerance is a well-described consequence of space flight, and 
prevention is needed to protect crew health and minimize operational impacts. Symptoms 
and consequences of orthostatic intolerance include dizziness, confusion, and loss of 
consciousness, which may result in an inability to operate controls, complete mission critical 
tasks, and egress from the vehicle without assistance. Thus, without appropriate mitigation, 
a crewmember suffering from the effects of orthostatic intolerance could jeopardize safe and 
successful reentry, landing, and egress, particularly in the event of an emergency before 
support personnel are available. 


Mitigation strategies employed during Space Shuttle and International Space Station 
missions have included fluid/salt loading regimens prior to reentry to partially counteract 
space flight-induced losses of plasma volume, compression garments to prevent blood 
pooling in the lower body and abdomen, liquid cooling garments to prevent heat stress- 
induced orthostatic hypotension and to maintain crew comfort, and recumbent crewmember 
seating for long-duration crewmembers to minimize the effects of acceleration along the long 
axis of the body. Thus, the orthostatic protection requirement is tightly coupled with 
3.2.5.11.5 Suit Accommodation of Metabolic Heat Loads and 3.10.19.5 Water for Fluid 
Loading, to ensure adequate cooling and water loading, respectively. 


To improve venous return, the mean compression provided by lower body garments should 
be between 40 to 80 mmHg. These levels are similar to those provided by the countermeasure 
garments used by NASA that includes the NASA Anti-Gravity Suit and the Russian Kentavr. 
These have been efficacious during Shuttle and Soyuz landings. Graded pressure may be 
advantageous, and if used is to be applied with highest pressure at the foot/ankle, lower 
pressure up the leg, and lowest pressure over the abdomen to the level of the diaphragm. 


Refer to HRP-47072 Human Research Program Evidence Book: Risk of Orthostatic 
Intolerance During Re-exposure to Gravity and NASA/SP-2010-3407 Human Integration 
Design Handbook (HIDH) paragraphs 6.5.2.2 and 6.5.2.4 for information on cardiovascular 
deconditioning and orthostatic intolerance due to spaceflight, and for details of extensive 
research performed by NASA on protective garments. 


3.5.1.6 Crew Egress Paths 


The CTS shall provide more than one crew egress path out of the spacecraft when in the landing 
configuration. [R.CTS.092] 


Rationale: For an off-nominal landing where a vehicle may be on its side, or in cases where 
there is an obstruction present, the primary egress path may not be useable; therefore, an 
alternate means of crew egress from the spacecraft should be available in order to allow the 
crew to reach safety in the event of emergencies in the post-landing timeframe. 


3.5.1.7 Communications with CVCC after Landing 


The spacecraft shall provide 2 hours of cumulative post landing two-way voice communications, 
over a 24 hour period, between the crew and the CVCC until recovery/rescue forces have 
removed the crew from the vehicle. [R.CTS.095] 


Rationale: The crew should have periodic two-way voice communications with the 
operations team sufficient to aid in spacecraft safing and coordinate the recovery or search 
and rescue and other crew survival efforts during this timeframe. The communication will 
need to be maintained until the search and rescue or recovery teams have recovered the crew 
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for nominal and off nominal landing scenarios. 5 minutes of continuous two-way voice every 
hour for 24 hours (reference requirement 3.5.2.4 Crew Survival After Landing) will satisfy 
search and rescue needs. This requirement does not preclude the use of portable devices as 
part of a strategy to provide two-way voice communications between the crew and the CVCC 
until recovery forces have removed the crew from the vehicle. 


3.5.1.8 Spacecraft Voice Communication with Recovery/Rescue Forces 


The spacecraft shall provide two-way voice communication between the crew and the 
recovery/rescue forces from the time the recovery/rescue forces are within direct line-of-sight of 
the spacecraft until recovery/rescue forces have removed the crew from the spacecraft. 


a. The spacecraft shall be capable of communicating on International Air Distress (IAD) 
frequency of 121.5 MHz and Military Air Distress (MAD) frequency of 243.0 MHz. 
[R.CTS.353] 


Rationale: The crew should have two-way voice communications with the recovery/rescue 
forces that will be conducting the search and rescue and other crew survival efforts during 
this timeframe. The communication will need to be maintained until the search and rescue or 
recovery teams have recovered the crew for nominal and off nominal landing scenarios. It is 
assumed that it will take 4 hours for the rescue and recovery forces to remove the crew from 
the spacecraft. The CTS should develop and coordinate other special frequencies for use 
beyond the IAD and MAD frequencies for all operations that are not considered search and 
rescue. This requirement does not preclude the use of portable devices as part of a strategy 
to provide two-way voice communication between the crew and recovery/rescue forces. This 
requirement should not require the crew to open the egress hatches to maintain 
communication with recovery/rescue forces because the spacecraft may be in a contingency 
landing situation, such as in a water landing, which would preclude opening the hatches. 


3.5.2 Contingency 


Note: These contingency requirements are in addition to those required for a nominal landing, as 
defined in Section 3.5.1. 


3.5.2.1 Emergency Entry Capability 


The CTS shall provide emergency systems for entry, descent, and landing (EDL) to return the 
crew to Earth. [R.CTS.096] 


Rationale: The intent of this requirement is to provide emergency entry, descent, and landing 
(EDL) system, analogous to the abort emergency system on ascent that allows for crew 
return to Earth in the event that the failure tolerance designed into the system is unsuccessful 
in controlling a potentially catastrophic hazard. The emergency systems are not required to 
achieve the requirements of a nominal landing at the designated landing site(s); rather, they 
are in place to provide a survivability path for the crew. 


3.5.2.2 Sea State Landing Limits for Aborts 


The spacecraft shall function after landing in sea state conditions at the limit in Figure 3.5.2.2-1 
for aborts designated for a water landing. [R.CTS.373] 


Rationale: During aborts designed for a water landing, there is a risk the spacecraft may 
land in hazardous sea states with degraded weather. The vehicle must be designed to land 
safely so that it can perform its post-landing functions and prepare for subsequent crew 
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rescue. Designing to these limits may maximize rescue opportunities. The sea state rescue 
conditions found in Figure 3.5.2.2-1 are based on Apollo experience and Post-landing Orion 
Recovery Tests (PORT) performed in 2009 with military rescue forces. 
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Figure 3.5.2.2-1: Sea State Design limits for Crew Rescue 


3.5.2.3 Runway Landing Weather Limits for Aborts 


The spacecraft shall perform abort landings in the environmental limits in Table 3.5.2.3-1 for 
aborts designated for a runway landing. [R.CTS.374] 


Rationale: During aborts designed for a runway landing, there is a risk the spacecraft may 
land on runways with degraded weather. The landing conditions are based on current 
commercial aviation capabilities without differential GPS. 


Table 3.5.2.3-1: Runway Abort Landing Weather Limits 
500 


Runway 1 
Visual Range _— 
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3.5.2.4 Crew Survival after Emergency Landing 


The spacecraft shall provide for crew survival for 24 hours after an emergency landing, while 
limiting core body temperature excursions above 100.5 °F but no greater than 102.6 °F for less 
than 45 minutes cumulative. [R.CTS.093] 


Rationale: Twenty four hours is the longest time that the ground support would take to 
recover the crew in an emergency landing scenario, such as an emergency deorbit scenario 
where landing occurs in a remote location. In harsh environments, the providers must 
develop a crew survivability strategy that determines crew actions and vehicle and survival 
kit capabilities required to transition into and operate in this survival mode. The crew 
expenditure of energy and minimal available cooling in remote locations make core body 
temperature regulation critically important to prevent heat-related illnesses. The strategy 
must address tasking required to safe the vehicle, doffing the suits and configuring for a 
sustained loiter phase while awaiting rescue. This requirement would allow for crew egress 
if conditions for egress were safe to do so (i.e., land landing where the crew is able to open 
the hatch and egress the spacecraft in a deconditioned state). 


3.5.2.5 Spacecraft Ventilation for Emergency Landings 


The spacecraft shall provide cabin ventilation equivalent to 4 cabin air exchanges per 
crewmember per hour while crew is present after an emergency landing. [R.CTS.364] 


Rationale: A remote landing could subject the spacecraft and crew to harsh environmental 
conditions ranging from high atmospheric temperatures to rough seas. If the crew must 
remain in the vehicle, this ventilation will equalize cabin temperature, mitigate CO2 build- 
up, and replenish O2. The duration of this service and the variability of ventilation rates 
with landing environments are developed in conjunction with the crew survivability strategy 
in requirement 3.5.2.4. 


3.5.2.6 Crew Survival Kit 


The spacecraft shall provide a crew survival kit to support all crewmembers for at least 24 hours 
following an emergency landing. [R.CTS.094] 


Rationale: A crew survival kit must be provided for crew health and safety. In the event of 
an emergency landing to an unsupported site, the crew may be sheltered in the vehicle for up 
to 24 hours post-landing. In addition, the crew survival kit must provide readily-accessible 
survival rations and equipment to support crew needs while awaiting rescue. This kit should 
be portable and not rely on vehicle resources for functionality such that it can be taken with 
crew in the event of egress. The emergency landing location and conditions are often 
unpredictable, thus an integrated task analysis should be performed to ensure the survival kit 
provides support in all potential scenarios. Guidance on the task analysis process can be 
found in Section 4.1 of JSC 65995, Commercial Human System Integration Processes 
(CHSIP). The development of a crew survival kit should include search and rescue 
equipment (e.g., life raft, radio, beacons, twine, knives, and a signal kit) and crew survival 
items (e.g., food, water, first-aid items, etc.). 


3.5.2.7 Support Crew Rescue After Emergency Landing 


The CTS shall support rescue of the flight crew by NASA-designated rescue forces in the event 
of an emergency landing at an unsupported landing site: 
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a. The CTS shall provide spacecraft-specific emergency rescue equipment to NASA-designated 
rescue forces. 


b. The CTS shall provide CTS-specific emergency rescue training to NASA-designated rescue 
forces. 


c. The CTS shall assist NASA-designated rescue with CTS assets and resources for landings in 
proximity to supported landing sites. [R.CTS.393] [I] 


Rationale: The government will provide augmented rescue services for emergency landings 
at unsupported landing sites. Note - The NASA-designated rescue forces will not retrieve the 
cargo or salvage the spacecraft. Spacecraft-specific rescue equipment, such as a sea 
anchor(s) and stabilization collar(s) are essential tools to enable a rescue at sea, providing a 
work platform to assist in the extraction of crewmembers. Spacecraft-specific rescue 
equipment to support assisted egress for land landing at non-supported sites may also be 
required. Equally important are attach points for attaching this equipment to the spacecraft 
and tethering rescue personnel or flight crew. Equipment to monitor hazardous conditions 
outside the spacecraft may also be required to ensure safe rescue operations. This 
equipment may reside on the spacecraft or may be multiple sets of ground support equipment 
(GSE) provided to NASA-designated rescue forces. Training specific to the CTS system will 
need to be provided to NASA-designated training instructors in order to identify any 
potential post-landing spacecraft hazards to the rescue personnel and flight crew and to 
define the procedures for rescue personnel to operate the spacecraft hatches and employ any 
provided rescue equipment. Outside of the supported landing site, NASA will consider using 
CTS assets and resources planned for nominal landings to determine the scope and needs of 
the NASA-designated rescue forces. NASA-designated rescue forces will assist in crew 
egress from the spacecraft, may perform medical stabilization, and may provide 
transportation to a DMCF. 


3.5.3. Post-Landing Recovery 

3.5.3.1 Recovery after Nominal Landing 
The CTS shall recover the NASA flight crew, including their removal from the spacecraft, within 
1 hour of landing at a supported landing site(s). [R.CTS.097] [T] 


Rationale: The recovery time starts with touchdown and ends with the assisted crew removal 
from the spacecraft. It is unreasonable to expect the crew to remain in the spacecraft for an 
extended period of time in a deconditioned state without medical attention. For most 
landings, it is reasonable for the crew to safe the vehicle and be recovered within one hour 
after touchdown. 


3.5.3.2 RESERVED 
3.5.3.3 RESERVED 
3.5.3.4 RESERVED 
3.5.3.5 Recovery Lighting at Supported Sites 


The CTS shall perform recovery operations at supported sites in all ambient lighting conditions. 
[R.CTS.101] 


Rationale: The CTS is responsible for recovering the crew at all supported landings, in day 
or night lighting conditions to maximize landing opportunities at supported sites, which is 
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required due to the future ISS traffic models with resupply occurring from a multitude of 
vehicles. 


3.5.3.6 NASA Personnel Accompanying Recovery 


The CTS shall provide transportation and delivery of 30 NASA personnel and their equipment 
from a CTS-designated staging location to the supported landing site. [R.CTS.102] [I] 


Rationale: Transportation must be provided for NASA landing support personnel and 
government furnished equipment (GFE) hardware/equipment/supplies (such as crew health 
unique supporting hardware and supplies and payload-unique ground and flight hardware) 
to travel from a mutually agreed CTS-designated staging location (which may include sites 
on land, such as a continental US Airport, or water) to the supported landing site. The 
complement of NASA personnel transported to the landing site may be different for each 
mission but will not exceed 30 people. NASA personnel include flight surgeons and nurses to 
provide medical care for each NASA-sponsored crewmember, Program Management, and 
other required personnel to assist the crew and handle time-critical cargo in the post-landing 
timeframe. The number of personnel required could be slightly higher for baseline data 
collection and/or additional time-critical cargo requirements. 


3.5.3.7 Transport NASA Personnel and Cargo from Landing Site 


The CTS shall provide transportation and delivery of the NASA crew, returning ISS time-critical 
cargo, 30 NASA personnel, and equipment to transfer to NASA at a continental U.S. airport 
within 2 hours after the completion of the NASA medical assessment at a supported landing site 
using air transportation or transportation appropriate to landing site conditions. 


a. The CTS shall maintain cargo services post-landing per SSP 50833, Section 3.1.1. 
[R.CTS.103] [I] 


Rationale: When NASA flight surgeons determine NASA crew readiness post landing, CTS 
personnel transports the NASA crew, personnel, their equipment, and returning time-critical 
cargo to a continental U.S. airport within two hours. At the airport, CTS personnel assist 
with loading NASA crew, personnel, their equipment, and returning time-critical cargo onto 
the NASA-provided transportation. The two hour window, after completion of the NASA 
medical assessment, for transport to the airport is part of the overall timeline to ensure 
timely return of NASA crew for baseline data collection and preservation of time-critical 
cargo. 


3.5.3.8 Contingency Medical Evacuation 


The CTS shall provide medical evacuation capability at supported landing sites to return ill or 
injured crewmembers to a DMCF within | hour of crew egress. The medical evacuation 
capability shall include the following: 


a. One physician trained and proficient in Advanced Trauma Life Support (ATLS) per medical 
evacuation vehicle 


b. One Paramedic for each patient aboard the medical evacuation vehicle(s) 
c. Two NASA personnel to support crewmembers once arrived at DMCF [R.CTS.104] [I] 


Rationale: Nominal landings can turn into contingency events with no predictability. It is 
critical the CTS plan for full medical coverage and that the evacuation provisions are the 
same at all supported landing sites. In the event of a contingency at a supported landing site, 
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medical evacuation may be needed to transport ill or injured crewmembers to the 
appropriate medical care facility, normally a DMCF, in a timely manner. It is imperative 
that critical medical resources are on station at the supported landing site prior to the 
scheduled landing time ready to respond to unpredictable events whereby an expected 
nominal landing becomes a contingency with little or no notice. These medical resources 
should be close enough in proximity to the landing site to respond to a medical need within a 
reasonable timeframe. Extraction of injured crewmembers may delay medical evacuation 
and subsequent arrival at the DMCF. A trained physician is the best option for coordinated 
medical care involving multiple casualties and single point communication of relevant 
casualty assessment until arrival at the DMCF. Including one trained physician per medical 
evacuation vehicle plus a paramedic for each patient aboard the medical evacuation vehicle 
brings a greater medical capability in the shortest time to those injured and allows advanced 
treatment closer to the time of injury. Medical personnel need to have appropriate medical 
certification, a minimum level of training to support contingencies and need to understand 
the effects of space flight. The two NASA personnel, comprised of a NASA Flight Surgeon 
and Interpreter/Management, will assist the illinjured crewmember at the DMCF. 
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3.6 Crew Health Support 

3.6.1 RESERVED 

3.6.2 Medical Hardware Interfaces 


The spacecraft shall provide emergency medical oxygen to interface with ISS-provided 
respiratory equipment (per Table 3.6.2-1) used during the return of an ill or injured crewmember 
until egress. [R.CTS.318] [I] 


Rationale: The ISS Program has accepted the results of Integrated Medical Model analyses 
to determine and rank order the probabilities of medical conditions that would result in the 
medical return of an ISS crewmember. The top 10 diagnoses were used to establish medical 
hardware needs for crewmember support during return. In addition to medications and 
small items that would not require vehicle scarring, supplemental oxygen supplied by the 
returning vehicle is required to support ISS medical hardware used during the return. It 
must interface with standard ISS medical equipment that regulates the actual pressure and 
flow rate of oxygen delivered to the crewmember. 


Table 3.6.2-1 Medical Hardware Interfaces 


Physical Interface per drawing SEG33105312 (or equivalent) 
Supply pressure, flowrate, and temp to respiratory | up to 6 slpm of medical oxygen at 55—103 degF 
equipment and 65-120 psia 
Supply pressure, flowrate, and temp from up to 6 slpm of medical oxygen at 70—90 degF at 
respiratory equipment to spacecraft cabin ambient pressure 

3.6.3 Privacy of Health and Medical Data 


3.6.4 


The CTS shall ensure the privacy of all crew health and medical related data. [R.CTS.107] 


Rationale: Provisions of the Privacy Act of 1974, as amended, regarding control of records, 
information exchange, and release of crewmember health information to the public will be 
strictly followed. Communications pertaining to an individual's health care will be private 
as regulated by the controls, regulations, provisions, and penalties of the Privacy Act of 
1974. Privacy is required to protect against unintentional distribution of private downlink 
crew medical and personal data. 


Health Stabilization 
The CTS shall meet JSC 22538, Flight Crew Health Stabilization Program. [R.CTS.109] [T] 


Rationale: A Health Stabilization Program (HSP) minimizes NASA ISS crew exposure to pre- 
flight illness and reduces the chance of launch delays, crew replacement, or decrements to 
mission performance due to crew illness. As part of this program, a health awareness 
campaign is initiated 30 days prior to launch to make non-flight crewmembers, families, and 
co-workers aware of the provisions of the HSP to help guard against the spread of infectious 
disease during the HSP period. 
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3.7 Commercial Vehicle Control Center (CVCC) 

3.7.1. Ground Monitoring and Operation 
The CTS shall provide the capability for ground personnel to remotely monitor, operate, and 
control the integrated space vehicle and subsystems from the CVCC(s), where: 
a. The remote capability is necessary to execute the mission. 
b. The remote capability would prevent a catastrophic event. 
c. The remote capability would prevent an abort. [R.CTS.110] 
Rationale: Logically, there will be times when a remote capability to monitor, operate and 
control the integrated space vehicle and subsystems is required to augment crew activities. 
Additionally, ground personnel may need this capability because they have access to more 
data than the crew, augmented analysis capabilities, or information that may not be readily 
available onboard, such as landing site weather and other ground infrastructure status 
information. 
This capability is not intended to force 100% communication coverage for all elements of the 
system. Unless specified in Section 3.8.1, the communication coverage will be planned to 
implement the capability to meet the three conditions listed above. 

3.7.2 RESERVED 

3.7.3. CVCC/MCC-H Data Integration 


The CVCC shall exchange data with the NASA ISS MCC-H to enable real-time mission support. 
[R.CTS.112] [TJ 


Rationale: The NASA ISS Flight Control team will require telemetry, voice, video, and 
trajectory data to execute the joint mission in partnership with the CVCC. Real-time 
operations include pre-launch and post-landing. 
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3.8 Spacecraft 
3.8.1 Communications 
3.8.1.1 Voice Communication with Crew 


The CTS shall provide single failure tolerant two-way voice communication between the CVCC 
(s) and the spacecraft crew from pre-launch through landing and during aborts. [R.CTS.113] 


Rationale: Two-way voice communication between the CVCC (s) and the crew is required to 
execute the mission and resolve anomalies should they occur. The intent of this requirement 
is to provide single failure tolerance in both the ground and onboard communications 
systems in order to ensure communications availability during all flight phases. This 
requirement is not meant to imply 100% continuous communication for all phases of flight. 
Onorbit communications coverage requirements will be dictated by the specific design 
requirements of the spacecraft. 


3.8.1.2 Communications Coverage 


The CTS shall provide communications coverage (two-way voice and telemetry) between the 
integrated space vehicle and CVCC(s) during at least 90% of the powered ascent flight phase and 
65% during the entry flight phase to supported landing sites. [R.CTS.114] 


Rationale: Historically, the ascent and entry phases of human space flight have been the 
timeframe of greatest risk for LOC. For powered ascent, there are a multitude of abort 
options and timely systems responses that ground personnel can assist with leading to the 
requirement near continuous communications that can be accommodated by ground and/or 
space based communication assets. For entry, although the risk is high, there are fewer 
options available for the crew and thus the requirement for continuous communication is less 
than that for ascent. Entry communications coverage to supported landing sites is intended 
to limit the number of trajectories for nominal entry assessment. The entry communication 
analysis should be focused on critical events (separations, chute deployment key navigation 
events) and the final phase of landing where the risk is the highest. 


3.8.1.3 RESERVED 
3.8.1.4 Private Audio 


The CTS shall provide for a private audio communications capability between the NASA crew 
and the NASA flight surgeon during non-docked, onorbit operations. [R.CTS.116] 


Rationale: This secured or private communication provides for privacy of medical 
information between the NASA crew and the NASA flight surgeons per the Privacy Act of 
1974. Private voice communications are not required during ascent and entry due to the 
short nature of these flight phases. Voice communications are considered private with 
respect to those on the ground. No additional impacts to vehicle design should result from 
establishing private communication, as the information is not required to be private between 
crewmembers. 


3.8.1.5 Integrated Voice Communications during ISS Proximity and Docked Operations 


The CTS shall provide simultaneous two-way voice communications between the ISS, CTS 
spacecraft, CVCC, and ISS Mission Control Center during: 


a. Free flight when the CTS spacecraft is within 10 kilometers of the ISS. 
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b. Docked operations when the crew is in the CTS spacecraft. [R.CTS.117] [I] 


Rationale: The intent of this requirement is to supplement other requirements in this 
document (3.7.3 and 3.8.1.1) and in SSP 50808 so that the CTS enables a multi-party voice 
loop conferencing the ISS, CTS spacecraft, CVCC, and ISS Mission Control Center when the 
CTS spacecraft is within 10 kilometers of the ISS to support nominal and contingency 
operations. This requirement includes providing voice communication when the crew is 
isolated in the CTS spacecraft while attached to ISS (i.e., Safe Haven). This requirement 
enables conferencing of all the operations entities (ISS crew, CTS spacecraft crew, CVCC 
flight control team, and ISS flight control team) to support proximity and docking operations. 
This does not require direct point-to-point communication between all parties. 


3.8.1.6 RESERVED 
3.8.1.7 Command and Telemetry Communications 


The CTS shall provide single failure tolerant command and telemetry communication between 
the integrated space vehicle and the CVCC(s) from pre-launch through landing and during 
aborts. [R.CTS.351] 


Rationale: Command and telemetry communication between the CVCC (s) and the crew is 
required to execute the mission and resolve anomalies should they occur. The intent of this 
requirement is to provide single failure tolerance in both the ground and onboard 
communications systems in order to ensure communications availability during all flight 
Dhases. This requirement is not meant to imply 100% continuous communication for all 
phases of flight. Onorbit communications coverage requirements will be dictated by the 
specific design requirements of the spacecraft. 


3.8.1.8 Communication 


The CTS shall satisfy communications performance in the expected operating environment and 
ensure compatibility with existing users of the same spectrum. [R.CTS.380] 


Rationale: Radio frequency spectrum is a shared commodity and therefore, design 
parameters for a radio communication system with consideration of the expected radio 
frequency environment are essential. Maintaining communications performance in the 
expected operating environment and compatibility with existing spectrum users delivering of 
the minimum required data through the communications link during phases of flight where 
coverage is required. It is also important to ensure that other NASA Systems and users are 
not impacted by the implementation of the CTS frequency links and modes. 


3.8.2 Command Link Security 
Note: These requirements apply to any command link with the vehicle during all phases of flight. 


3.8.2.1 Advanced Encryption Standards 


The CTS shall secure hardware and software implementation of the decryption and encryption 
for all commands, excluding FTS commands. The system shall implement Federal Information 
Processing Standard (FIPS) Publication 197, Advanced Encryption Standard (AES), or available 
NSA-endorsed and NIST-certified TDEA crypto module, for all encrypted data exchanges. 
[R.CTS.122] 
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3.8.2.2 Requirements for Cryptographic Modules 


The CTS shall perform cryptographic operations using devices that meet FIPS Publication 140-2, 
Security Requirements for Cryptographic Modules, Level 2 Certification. [R.CTS.123] 


3.8.2.3 Cryptographic Key Management 


The CTS shall manage cryptographic keys in accordance with the National Institute of Standards 
and Technology (NIST) SP 800-57, Recommendation for Key Management-Part | and with 
NASA COMSEC Office of Record located at the NASA Kennedy Space Center. [R.CTS.124] 


Rationale: The Command Link Security Section requirements are necessary to protect the 
command link to spacecraft and launch vehicle so that unauthorized commanding with the 
potential for catastrophic results cannot occur. 


3.8.3 Onorbit Maintenance 
3.8.3.1 Preventative Maintenance 


The CTS shall have no more than 2 crew hours of Intravehicular Activity (IVA) preventative 
maintenance every 30 days during ISS docked operations. [R.CTS.126] [T] 


Rationale: ISS crew time is reserved for science and other operations. The spacecraft design 
should minimize the amount of maintenance required to avoid impacts to the ISS crew 
productivity. 


3.8.3.2 Maintenance Tools 


The CTS shall provide all unique tools required for onorbit maintenance and reconfiguration. 
[R.CTS.127] 


Rationale: In general onorbit maintenance should be avoided, but if needed, tool design 
should be based on selecting tools that are familiar to crewmembers and minimizing the 
number of different tools. Also, tools are to be usable by the full range of crew sizes and 
strengths wearing expected protective equipment (protective eyewear, gloves, etc.). Use of 
the ISS tools should be considered for the mission phase when the spacecraft is attached to 
the ISS. The ISS available tools list can be found in SSP 41000 System Specification for the 
International Space Station Table XLVIII Standard IVA Tool List and Table XLIX IVA 
Diagnostic Equipment List. 


3.8.4 Manual Control 
3.8.4.1 Manual Control of Vehicle Flight Path 


The spacecraft shall provide the capability for the crew to manually control the vehicle flight 
path, attitude, and attitude rates during all actively controlled phases of flight following the 
separation of the spacecraft from the launch vehicle, excluding ISS mated operations. 
[R.CTS.128] 


Rationale: The capability for the crew to control the spacecraft's flight path is a fundamental 
element of crew survival. Manual control means that the crew can bypass the automated 
guidance of the vehicle to interface directly with the flight control system to affect any flight 
path within the capability of the flight control system. Limiting the crew to choices presented 
by the automated guidance function is not a valid implementation of manual control. 

Manual control does not mean the capability to bypass the flight control system. Also, for 
phases of flight where there is no active control of the spacecraft, such as when under 
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Passive parachutes, then manual control cannot be provided and this requirement would not 
apply. During highly dynamic launch abort engine firings, following spacecraft separation 
from the launch vehicle, where thermal, structural, or control margins are low, this 
requirement is not applicable; however, this requirement is applicable to abort engine firings 
where margins and dynamics allow safe manual control. 


3.8.4.2 Manual Piloting for Docking 


The spacecraft shall provide for crew manual piloting within the ISS approach ellipsoid to 
perform docking. [R.CTS.385] [I] 


Rationale: Crew manual piloting to accomplish docking is a means to mitigate the risk of 
LOM. In the event an automated docking system is used, manual piloting would ensure 
dissimilar redundancy. Manual piloting means that the crew can bypass the automated 
guidance of the vehicle to interface directly with the flight control system to affect any flight 
path within the capability of the flight control system for maneuvers within the approach 
ellipsoid. In order to safely accomplish these maneuvers, the pilot must have the necessary 
flight data and visual cues. Without manual docking, the crew will be forced to abort their 
mission and potentially re-fly the mission at additional crew risk and program cost if 
failure(s) rendered an automated system unavailable. 


3.8.4.3 Handling Qualities 


The spacecraft shall exhibit Level 1 handling qualities (Handling Qualities Rating (HQR) 1, 2 
and 3), as defined by the Cooper-Harper Rating Scale, during manual control of the spacecraft's 
flight path and attitude during all mission phases, beginning with spacecraft separation from the 
launch vehicle and including ISS proximity/docking operations, when manual control is the 
primary control mode or automated control is non-operational. 


a. The spacecraft shall exhibit Level 2 or better handling qualities (HQR 1- 6), in all other 
scenarios. [R.CTS.129] 


Rationale: Level 1 handing qualities are the accepted standard for manual control of flight 
path and attitude in military aircraft. Level I handling qualities will allow the crew to 
effectively control the spacecraft when necessary for mission completion or to prevent a 
catastrophic event. Non-operational is defined as automated control system failed or not 
enabled. 


Selected manual control scenarios that must meet Level I handling qualities will be defined 
via review of potential manual control scenarios. A scenario includes one or more handling 
quality related vehicle control tasks performed during a flight phase under specified 
conditions. A handling quality related task is defined as the manual control capability that is 
being rated with the Cooper-Harper Rating Scale (see Appendix L). Guidance on the 
assessment of vehicle handling qualities and the use of the Cooper-Harper scale can be 
found in Section 4.6 of JSC 65995, Commercial Human System Integration Processes 
(CHSIP). Handling qualities must be provided in accordance with NPR 8705.2B, Section 
3.4.2. 


3.8.4.4 Windows for Crew Tasks 


The spacecraft shall provide windows that are available for use by the crew through all phases of 
flight that provide direct, non-electronic, through-the-hull viewing and the unobstructed fields- 
of-view necessary to perform crew viewing tasks. [R.CTS.177] 
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Rationale: Windows provide direct, non-electronic, through-the-hull viewing and are 
essential to mission safety and success, as well as to maintaining crew situational awareness 
and psychological and physical health and safety. They do not have the failure modes 
associated with cameras and display systems that may not be operable during emergencies 
when most needed and are essential for piloting and photography. They also permit stellar 
navigation, vehicle anomaly detection and inspection, and environmental and scientific 
observations. NASA experience is that two piloting windows are required to achieve the field 
of view necessary to accomplish the breadth of piloting tasks. Because of the criticality of 
windows to crew safety and success of the mission, windows must be a part of the spacecraft 
design and available through all flight phases without obstructions to their use. Fixed 
equipment, such as window instrumentation, hardware, or a condensation prevention system, 
that would obstruct or obscure the field-of-view of the window from the normal crew viewing 
position will interfere with crew tasks and must not be placed within the sight lines through 
the window; however, the following are not considered obstructions: hardware used in 
conjunction with piloting, such as a head's up display (HUD), crew optical alignment system 
(COAS), or other similar equipment; the outer mold line and hull structure of the vehicle 
itself; other windows and window mullions; and instrumentation applied to the window itself 
within 13 mm (~0.5 in.) of the perimeter of the clear viewing area. For detailed design 
considerations for inboard and outboard window view obscuration exclusion zones, consult 
Sections 8.6.3.3 and 8.6.3.4 in NASA/SP-2010-3407, Human Integration Design Handbook 
(HIDHA), which also provides extensive guidance for window design considerations. 


3.8.5 Crew Interface 
3.8.5.1 General Crew Interfaces 
3.8.5.1.1 Crew Control of Vehicle 


The integrated space vehicle shall provide the capability for the crew to monitor, operate, and 
control the integrated space vehicle and subsystems, where: 


a. The capability is necessary to execute the mission. 
b. The capability would prevent a catastrophic event. 


c. The capability would prevent an abort. [R.CTS.130] 


Rationale: This capability flows directly from the definition of certifying the integrated space 
vehicle to function with the crew during all flight phases. Within the context of this 
requirement, monitoring is the ability to determine where the vehicle is, its condition, and 
what it is doing. Monitoring helps to create situational awareness that improves the 
performance of the human operator and enhances the mission. Determining the level of 
operation over individual functions is a decision made separately for specific space systems. 
Specifically, if a valve or relay can be controlled by a computer, then that same control could 
be offered to the crew to perform that function; however, a crewmember probably could not 
operate individual valves that meter the flow of propellant to the engines, but the function 
could be replaced by a throttle that incorporates multiple valve movements to achieve a 
desired end state (reduce or increase thrust). Meeting any of the three stated conditions 
invokes the requirement. The first condition recognizes that the crew performs functions to 
meet mission objectives and, in those cases, the crew is provided the designated capabilities. 
This does not mean that the crew is provided these capabilities for all elements of a mission. 
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Many considerations are involved in making these determinations, including capability to 
perform the function and reaction time. The second and third conditions recognize that, in 
many scenarios, the crew improves the performance of the system and that the designated 
capabilities support that performance improvement. It is recognized that there are situations 
where it is not feasible to provide the crew the capability to prevent an abort. For example, 
during ascent aborts, the time to detect an abort condition and activate the abort system may 
be less than the time for the crew to evaluate the condition, make a determination they must 
prevent an abort, and then perform the necessary tasks to prevent the ascent abort. 


3.8.5.1.2 Tolerate Inadvertent Action 


The CTS shall be designed to tolerate inadvertent operator action (minimum of one inadvertent 
action), as identified by the human error analysis for all mission phases to include operations 
planned for response to system failures, without causing a catastrophic event. [R.CTS.131] 


Rationale: An operator is defined as any human that commands or interfaces with the space 
system during the mission, including humans in the control centers. The appropriate level of 
protection (i.e., one, two, or more inadvertent actions) is determined by the integrated human 
error and hazard analysis. 


3.8.5.1.3. Controls for Human Error 
The CTS shall implement controls to human error according to the following precedence: 
Prevent human error in the maintenance, operation, and control of the system. 


b. Reduce the likelihood of human error and provide the capability for the human to detect and 
correct or recover from the error. 


c. Design the system to limit the negative effects of errors. [R.CTS.132] 
3.8.5.1.4 Tolerate Inadvertent Action during Failure 


The CTS shall tolerate inadvertent operator action, as described in requirement 3.8.5.1.2, in the 
presence of any single system failure. [R.CTS.134] 


Rationale: The intent of this requirement is to provide a robust human system interface 
design that cannot be defeated by a system failure. Where the system is designed to protect 
for more than one inadvertent action, the level of protection after a single system failure may 
be reduced, but still protects from a single inadvertent operator action. In addition, this 
ensures that back-up capabilities, such as back-up flight software, maintain the same-level of 
tolerance to human error as the primary system. 


3.8.5.1.5 Operable by Single Crewmember 


The spacecraft shall be operable by a single crewmember for operations that require crew 
control. [R.CTS.135] 


Rationale: The vehicle must be designed so that mission events can be completed by a single 
crewmember. In addition, vehicle design for single crewmember operations drives 
operations simplicity and contributes to operations affordability. This requirement results 
from lessons learned from the Shuttle cockpit, which had critical switches that are out of the 
operator's reach zone and software that requires more than one crewmember to perform a 
nominal operation. This requirement does not preclude provision of multiple crew stations 
for backup and crew resource management (CRM) operations. 
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3.9 Spacecraft and Launch Vehicle Design Manufacturing Standards 
3.9.1 Materials and Processes 
3.9.1.1 Materials and Processes 


The CTS shall meet the intent of NASA-STD-6016, Standard Materials and Processes 
Requirements for Spacecraft. Deviations from materials and processes requirements shall be 
documented and approved using the intent of the Materials Usage Agreement (MUA) as defined 
in NASA-STD-6016. [R.CTS.260] 

3.9.1.2, Cabin Materials Flammability 


The spacecraft shall use materials in the pressurized cabin that meet the flammability 
requirements of NASA-STD-6016 in 30% oxygen at a pressure of 10.2 psia. [R.CTS.376] 


Rationale: The most severe environment for material flammability will be 30% O2 at a 
pressure of 10.2 psia. The cabin depressurization event is the bounding case with respect to 
flammability for all cabin operating pressures. 


3.9.2 Flight and Ground Software 
3.9.2.1 Software Engineering Requirements 


The CTS shall meet the intent of NPR 7150.2A, NASA Software Engineering Requirements for 
all flight and ground software products classified as Class A software per Appendix E of NPR 
7150.2A, or safety critical as defined in NASA-STD-8719.13, Appendix A, that adversely 
affects the operation of the Class A products. A requirements mapping matrix is provided for 
each software class and criticality in Appendix D of NPR 7150.2A. [R.CTS.262] 


3.9.3 Electrical and Avionics 
3.9.3.1 Use of Silver 
3.9.3.1.1 Electrically Deposited Silver 


The CTS shall not use electrically deposited silver as plating on printed wiring boards and 
terminal boards because of potential dendrite growth. [R.CTS.266] 


3.9.3.1.2 Silver Plating 


The CTS shall not use silver plating on bus bars and mechanical electrical contacts, such as 
connector pins and sockets, because it can tarnish and degrade electrical conductivity. 
[R.CTS.267] 


3.9.3.2 RESERVED 
3.9.3.3 Printed Wiring Boards 
3.9.3.3.1_ Printed Board Design Standards 


The CTS shall meet the intent of the requirements defined in IPC-2221, Generic Standard on 
Printed Board Design, as well as the associated technology performance specification under the 
IPC-2220 series per Performance Class 3. [R.CTS.268] 
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3.9.3.3.2 Qualification of Printed Boards Standard 


The CTS shall meet the intent of the requirements defined in IPC-6011, Generic Performance 
Specification for Printed Boards, as well as the associated technology performance specifications 
of the IPC-6010 series per Performance Class 3 (and Class 3/A). [R.CTS.269] 


3.9.3.3.3 Conductor Size Standard 


The CTS shall meet the intent of the requirements defined in IPC-2152, Standards for 
Determining Current Carrying Capacity in Printed Board Design per Performance Class 3. 
[R.CTS.270] 


3.9.3.4 Printed Wiring Assemblies 
3.9.3.4.1 Printed Wiring Assemblies 


Electrical circuitry shall be designed and fabricated to prevent the production of unwanted 
current paths by debris or foreign materials floating in the spacecraft microgravity environment. 
[R.CTS.271] 


3.9.3.5 Fiber Optics 
3.9.3.5.1 RESERVED 
[R.CTS.272] 
3.9.3.5.2 Fiber Optic Connection Standard 


The CTS shall meet the intent of NASA-STD-8739.5, Fiber Optic Terminations, Cable 
Assemblies, and Installation. [R.CTS.273] 


3.9.3.6 Staking/Conformal Coating 
3.9.3.6.1 Staking/Conformal Coating 


The CTS shall meet the intent of the requirements in NASA-STD-8739.1, Workmanship 
Standard for Polymeric Application on Electronic Assemblies. [R.CTS.274] 


3.9.3.7 Electrical Soldering 
3.9.3.7.1_ Soldering Process and Controls Standard 


The integrated space vehicle shall meet the intent of IPC J-STD-001ES, Space Applications 
Electronic Hardware Addendum and IPC J-STD-001E, Requirements for Soldered Electrical and 
Electronic Assemblies. [R.CTS.275] 


3.9.3.7.2 RESERVED 
3.9.3.7.3 Soldering Performance Standard 


The CTS shall meet the intent of GEIA-STD-0005-1, Performance Standard for Aerospace and 
High Performance Electronic Systems Containing Lead-Free Solder. [R.CTS.277] 


3.9.3.7.4 Mitigation of Tin Whiskers 


The CTS shall meet the intent of GEIA-STD-0005-2, Standard for Mitigating the Effects of Tin 
Whiskers in Aerospace and High Performance Electronics. [R.CTS.278] 
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3.9.3.8 Electrical Crimping 

3.9.3.8.1 Wiring, Cables, Harnesses and Crimping 


The CTS shall meet the intent of NASA-STD-8739.4; however, terminal lugs, splices, and two- 
piece shield termination rings shall meet the tensile strength and electrical requirements of SAE- 
AS-7928, General Specification for Terminals, Lug: Splices, Conductor: Crimp Style, Copper. 
[R.CTS.279] 


3.9.3.9 Electrical Wire Wrapped Connections 
3.9.3.9.1 Electrical Wire Wrapped Connections 
The integrated space vehicle shall not use wire wrapping. [R.CTS.280] 
3.9.3.10 Electrical Bonding 
3.9.3.10.1 Electrical Bonding 


The integrated space vehicle equipment, subsystems, and systems shall be designed, 
manufactured, and integrated to meet the intent of NASA-STD-4003, Electrical Bonding for 
NASA Launch Vehicles, Spacecraft, Payloads, and Flight Equipment. [R.CTS.281] 


3.9.3.11 Batteries 
3.9.3.11.1 Batteries 


The integrated space vehicle battery systems shall meet the intent of the requirements defined in 
JSC 20793, Crewed Space Vehicle Battery Safety Requirements. [R.CTS.282] 


3.9.3.12 Other Processes 
3.9.3.12.1 RESERVED 
3.9.3.12.2 Component Mounting Guidelines 


The CTS shall meet the intent of IPC-CM-770E, Component Mounting Guidelines for Printed 
Boards per Performance Class 3. [R.CTS.284] 


3.9.3.13 Integrated Space Vehicle Electrostatic Charge Control 
3.9.3.13.1 LEO Charging Design Standard 


The spacecraft shall meet the intent of the requirements contained in NASA-STD-4005, Low 
Earth Orbit Spacecraft Charging Design Standard. [R.CTS.285] 


3.9.3.13.2 Electrostatic Discharge Control Program 


The CTS shall meet the intent of ANSI/ESD 820.20, Protection of Electrical and Electronic 
Parts, Assemblies, and Equipment (Excluding Electrically Initiated Explosive Devices), which 
will include establishing and maintaining an electrostatic discharge control program. 
[R.CTS.286] 


3.9.3.13.3 Electrostatic Design Thresholds 


The CTS shall meet the intent of IEC 61000-4-2, Electromagnetic Compatibility (EMC) Testing 
and Measurement Techniques-Electrostatic Discharge Immunity Test for Human Body Model 
(HBM) subassemblies, assemblies and equipment discharge levels, which do not apply to 
electrically-initiated explosive devices. [R.CTS.371] 
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3.9.3.14 Electromagnetic Interference Control 
3.9.3.14.1 Electromagnetic Interference Control 


The integrated space vehicle equipment, subsystems, and systems shall be designed, 
manufactured, and integrated to meet the intent of MIL-STD-461, Requirements for the Control 
of Electromagnetic Interference Characteristics of Subsystems and Equipment. [R.CTS.287] 


3.9.3.15 Electromagnetic Environmental Effects 
3.9.3.15.1 Electromagnetic Environmental Effects 


The integrated space vehicle equipment, subsystems, and systems shall be designed, 
manufactured, and integrated to meet the intent of the MIL-STD-464, Electromagnetic 
Environmental Effects Requirements for Systems. [R.CTS.288] 


3.9.3.16 Custom Electromagnetic Devices 
3.9.3.16.1 Custom Electromagnetic Devices 


The integrated space vehicle equipment, subsystems, and systems shall be designed, 
manufactured, and integrated to meet the intent of MIL-STD-981, Design, Manufacturing, and 
Quality Standards for Custom Electromagnetic Devices for Space Applications. [R.CTS.289] 


3.9.3.17 Lightning 
3.9.3.17.1 Lightning Protection Design 


The integrated space vehicle equipment, subsystems, and systems shall be designed, 
manufactured, and integrated to meet the intent of the requirements contained in the following 
documents in order to provide protection from the direct and indirect effects of the natural 
lightning environment, including triggered lightning: 


SAE ARP 5412A, Aircraft Lightning Environment and Related Test Waveforms. 


b. FAA AC 20-136B, Protection of Aircraft Electrical/Electronic Systems Against the Indirect 
Effects of Lightning. 


c. SAE ARP 5414A, Aircraft Lightning Zoning. 

d. SAE ARP 5577, Aircraft Lightning Direct Effects Certification. [R.CTS.290] 
3.9.4 Aerodynamic Deceleration Systems 
3.9.4.1 Trailing Deployable Aerodynamic Decelerator 
3.9.4.1.1 Trailing Deployable Aerodynamic Decelerator Design 


The integrated space vehicle shall meet the intent of JSC 65985, Requirements for Human 
Spaceflight for the Trailing Deployable Aerodynamic Decelerator (TDAD) during the design and 
development of parachute and other similar systems. [R.CTS.291] 


3.9.5 Mechanisms 
3.9.5.1 Mechanism Design 


The integrated space vehicle shall meet the intent of NASA-STD-5017, Design and 
Development Requirements for Mechanisms. The following sections are not applicable: 4.7, 
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Fastener Retention and 4.8.9, Preload Bolt Criteria (refer to requirement 3.9.8.3 for fastener 
requirements). [R.CTS.292] 


3.9.6 Thermal Protection System (TPS) 
3.9.6.1 Thermal Protection System (TPS) Design 


The spacecraft TPS shall meet the intent of JSC 65827, Thermal Protection System Design 
Standard for Spacecraft. [R.CTS.293] 


3.9.6.2 TPS Structural Design 


The integrated space vehicle TPS shall meet the intent of structural requirements per Section 
3.9.8. [R.CTS.372] 


3.9.7 Pyrotechnics 
3.9.7.1 Pyrotechnics 


The CTS shall meet the intent of JSC 62809, Human Rated Spacecraft Pyrotechnic Specification. 
[R.CTS.294] 


3.9.8 Structures 
3.9.8.1 Structural Design and Factors of Safety 
3.9.8.1.1_ Structural Design Requirements 


All flight hardware structures of the integrated space vehicle, except for glass or ceramic 
windows, shall meet the intent of JSC 65828, Structural Design Requirements and Factors of 
Safety for Spaceflight Hardware. [R.CTS.295] 


3.9.8.1.2. Windows Design 


The integrated space vehicle shall meet the intent of NASA-STD-5018 for window systems that 
utilize glass or ceramic panes. The following sections of NASA-STD-5018 are not applicable 
for commercial crewed vehicles: 4.6.3 and 5.6.3, 4.10.2 and 5.10.2. For window systems (or 
portions of window systems) that use non-brittle materials such as plastic panes refer to 
requirement 3.9.8.1.1 of CCT-REQ-1130. [R.CTS.296] 


3.9.8.2 Loads and Structural Dynamics 
3.9.8.2.1 Loads and Structural Dynamics 


The integrated space vehicle shall meet the intent of JSC 65829, Loads and Structural Dynamics 
Requirements for Spaceflight Hardware. [R.CTS.297] 


3.9.8.3. Fasteners 


The integrated space vehicle shall meet the intent of NASA-STD-5020, Requirements for 
Threaded Fastening Systems in Spaceflight Hardware. [R.CTS.298] 


3.9.9 Fluids, Propellants, Explosives, and Oxygen Systems 
3.9.9.1 Flexible Lines and Flow-Induced Vibration 


The CTS shall prevent flow-induced vibration (FIV) in metal bellows and flexhoses over their 
operating flow range +/-10% or show that part life is 4 times the operational life when FIV 
cannot be eliminated. 
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a. The FIV analysis to determine the predicted FIV flow range shall be performed to meet the 
intent of MSFC-DWG-20M02540, Assessment of Flexible Lines for Flow-Induced 
Vibration. 


b. The procedures for flow testing metal bellows and flexhoses to show acceptable operational 
life shall meet the intent of MSFC-SPC-626, Test Control Document for Assessment of 
Flexible Lines for Flow Induced Vibration. 


c. For those metal bellows and flexhoses used in the CTS which experience an operating flow 
excitation environment that is different (atypical) than the grazing flow environment 
described by MSFC-DWG-20M02540, then an alternative analysis technique shall be used. 
[R.CTS.303] 


Rationale: The occurrence of flow-induced vibrations in convoluted metal bellows and 
flexhoses can result in a structural fatigue failure. These flow-induced vibrations are a 
result of the coupling of vortex shedding from the flexible line convolutes with the natural 
frequencies of the flexible line. It is the intent of this requirement to avoid those flow ranges 
which produce FIV or to pursue other robust design and demonstration activities necessary 
to minimize the likelihood of a catastrophic failure of bellows and flexhoses. The 
alternative analysis technique is meant to address flow situations where the MSFC-DWG- 
20M02540 would not be applicable. 


3.9.10 Propulsion Systems 
3.9.10.1 Strength and Life Requirements for Propulsion Systems 


The integrated space vehicle shall meet the intent of NASA-STD-5012, Strength and Life 
Assessment Requirements for Liquid Fueled Space Propulsion Systems Engines. [R.CTS.304] 


3.9.11 Fracture Control 
3.9.11.1 Fracture Control 


The integrated space vehicle shall meet the intent of fracture control requirements in NASA- 
STD-5019, Fracture Control Requirements for Spaceflight Hardware. [R.CTS.307] 


3.9.12 Parts 
3.9.12.1 Parts 


The CTS shall meet the intent of the part selection criteria established in the SMC Standard 
SMC-S-010, Space and Missile Systems Center Standard, Parts, Materials, and Processes 
Technical Requirements for Space and Launch Vehicles. [R.CTS.319] 


3.9.13 Testing 
3.9.13.1 Ground Testing 


The integrated space vehicle and associated subsystems and units shall meet the intent of the 
environmental and structural ground testing requirements as defined in SMC Standard SMC-S- 
016, Test Requirements for Launch, Upper-Stage, and Space Vehicles. [R.CTS.315] 
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3.9.14 Models and Simulations 

3.9.14.1 Models and Simulations 
The CTS shall meet the intent of sections 4.1.1, 4.1.2, 4.7 and 4.8 of NASA-STD-7009 for all 
models and simulations that are utilized in making critical decisions. [R.CTS.381] 


Rationale: The intent is to ensure that the limitations and credibility of model- and 
simulation-based analysis results are clearly and consistently communicated to decision 
makers, since the output data from a model or simulation by itself does not provide sufficient 
information on which to base a critical decision. 
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3.10 Human Health, Medical and Performance 


The requirements in Section 3.0 work in conjunction with the human system interface design 
requirements in Appendix Q. These Appendix Q requirements apply to component-level 
implementation, human interface performance requirements, and design rules. A traceability matrix is 
provided in Appendix Q to show relationships between the design requirements and the parents they 
support. The parents can be found in any part of Section 3.0. The requirements in Appendix Q can 
either be allocated "as is" in the Provider’s specification or tailored to satisfy the parent requirement. 
Appendix Q is invoked by requirement 3.10.1. 


3.10.1 Human Interface Design Standards 


The CTS shall meet the intent of the human system interface design requirements in Appendix 
Q. [R.CTS.343] 


3.10.2 Crew Acceleration and Vibration Limitations 
3.10.2.1 Sustained Translational Acceleration Limits 


The CTS shall limit the magnitude, direction, and duration of crew exposure to sustained (> 0.5 
seconds) translational acceleration by staying below the limits specified in Appendix H, Figures 
H-2, H-3, H-4, H-5, and H-6. [R.CTS.216] 


Rationale: These limits represent safe levels of sustained translational acceleration for 
crewmembers under nominal and off-nominal conditions. The limits for entry (return to 
Earth) are lower than launch limits because crewmembers could have degraded capabilities 
because of deconditioning from exposure to reduced gravity. The lower entry limits also 
accommodate returning ill or injured crewmembers. For the extreme conditions of a launch 
abort or emergency entry, limits are higher because it may be necessary to expose the crew 
to accelerations more severe than those experienced nominally in order to return them safety 
to Earth. Crewmembers are never to be exposed to sustained translational acceleration 
rates greater than these elevated limits, as this significantly increases the risk of crew 
incapacitation, threatening crew survival. Each axis needs to be analyzed separately. 
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3.10.2.2 Rotational Velocity Limits 


The CTS shall limit crew exposure to rotational velocities in yaw, pitch, and roll by staying 
below the limits specified in Figure 3.10.2.2-1. [R.CTS.217] 
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3.10.2.3. Sustained Cross-Coupled Rotational Acceleration 


The CTS shall prevent the crew from being exposed to sustained (>0.5 seconds) cross-coupled 
rotational accelerations greater than 2 rad/s2. [R.CTS.218] 


Rationale: Crewmembers are not expected to be able to tolerate sustained cross-coupled 
rotational accelerations in excess of 2 rad/s2 without significant discomfort and 
disorientation. Sustained cross-coupled rotational accelerations exceeding this amount have 
been found to significantly impact human performance (e.g., neurovestibular performance 
via the "coriolis effect," physical reach, and cognition in Stone, R.W., & Letko, W. (1965)). 


3.10.2.4 RESERVED 
3.10.2.5 Acceleration Rate of Change 


The CTS shall prevent the crew from being exposed to a rate of change of acceleration of more 
than 500 g/s during any sustained acceleration event. [R.CTS.220] 
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Rationale: Acceleration onset rates greater than 500 g/s significantly increase the risk of 
crew incapacitation, thereby threatening crew survival. 


3.10.2.6 Health Limits for Vibration during Dynamic Phases of Flight 


3.10.3 


The CTS shall limit vibration to the crew such that the vectorial sum of the X, Y, and Z 
frequency-weighted accelerations between 0.5 and 80 Hz is less than or equal to 0.4 g rms over a 
10-minute period and 0.6 g rms over a one-minute period. [R.CTS.221] 


Rationale: There is limited data on the effects of high levels of vibration on health. It is 
expected that internal organs and tissue structures could be damaged if the level of vibration 
or the time period for these levels were increased. Studies were conducted in the 1960s to 
evaluate human tolerance to higher levels of vibration between 3 and 20 Hz for exposures 
lasting less than 5 minutes (Temple et al, 1964). These studies were conducted in the 
controlled laboratory environment with subjects supported by a rigid single-component 
space couch. A multiple component, non-rigid support may increase the risk of injury to the 
spinal column. In the semi-supine space couch configuration, the sustained accelerative 
forces (i.e., constant G-load bias equal to 1.0 G) are directed through the X-axis (back to 
chest) of the occupant. 


The main focus of complaints was pain or pressure in the thorax and difficulty with 
respiration. Discomfort was also reported in the abdomen and head. The 0.6-g weighted 
rms level falls in the vicinity of the upper boundary of the ISO 2631-1:1997, Annex B, Figure 
B.1 Health Guidance Caution Zones for a 1-minute exposure occurring during a 24-hour 
period. Above this boundary, health risks are likely. Below this boundary, caution for the 
potential for health risks is indicated. However, it should be noted that some individuals 
involved in the studies conducted by Temple et al were unable to withstand vibration at the 
0.6-g rms level for frequency components between 10 and 20 Hz because of severe 
discomfort. The 0.4-g weighted rms level for 10-minute exposure, however, is within the 
tolerance levels reported by Temple, et al (1964) for the frequencies between 3 and 20 Hz. 
The 0.4-g weighted rms level falls between the upper and lower boundaries of the ISO 
Standard 2631-1:1997, Annex B, Figure B.1 Health Guidance Caution Zones, where caution 
should be taken with regard to the potential for health risk. 


Dynamic Flight Occupant Protection 


This section presents the requirements for occupant protection in order to control hazards and 
limit injury risk presented by excessive crew loads due to high accelerations or insufficient crew 
restraint, particularly during landing or other dynamics flight scenarios such as ascent abort 
initiation. Additional hazard modes that may threaten occupant safety are structural failure or 
encroachment of hardware into the occupant volume, especially during off-nominal landing 
events. 


3.10.3.1 Brinkley Dynamic Response Model 


The CTS shall limit the injury risk criterion, B, to no greater than 1.0 for aborts and landings 
according to the Brinkley Dynamic Response model, utilizing Low DR level limits during 
nominal landings and Medium DR Level limits for off-nominal landings and abort events as 
defined in Table 4.3.10.3.1-1. [R.CTS.224] 


Rationale: The Brinkley Dynamic Response model will provide an injury risk assessment 
during dynamic phases of flight for accelerations less than 0.5 seconds. This model is used 
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for landing scenarios, but it is applicable for all dynamic phases of flight for accelerations 
less than 0.5 second. Application of the Brinkley Dynamic Response model is described in 
NASA TM-2013-217380, The Use of a Vehicle Acceleration Exposure Limit Model and a 
Finite Element Crash Test Dummy Model to Evaluate the Risk of Injuries During Orion 
Spacecraft Landings. As explained in Table 4.3.10.3.1-1, non-deconditioned crew should be 
used to select the dynamic response limits (DR) for aborts. For nominal and off-nominal 
landings, deconditioned crew should be used to select the dynamic response limits. 


3.10.3.2 Limitation of Crew Injury 


The CTS shall prevent injury to crewmembers due to blunt force trauma, point loads, flail, and 
injurious forces to the body including the head and neck during dynamic phases of flight. 
[R.CTS.225] 


Rationale: Upon landing impact, hardware and/or structure is likely to shift, deform, become 
projectiles, or otherwise impact the crew, potentially causing injury. Further, load paths 
that are not well distributed upon the occupant concentrate forces on the body to cause blunt 
force trauma, deep tissue damage, or other injurious force to the body. Likewise, 
crewmember limbs, if not restrained, may flail and impact vehicle structure, the 
crewmember's body, or other crewmembers. Unrestrained crewmember limbs may also 
present injury risks due to dangers such as joint hyperextension or hyper flexion. Impact 
with the crew may be injurious even if crew restraint and load attenuation is sufficient to 
allow crew survival. A volume surrounding the crewmember's body must be maintained 
without significant intrusion in order to minimize injuries. Implementation of protection 
against these hazards must not impede egress or vehicle operation. Head and neck 
protection was specifically cited as a critical area of protection by NASA/SP-2008-565 
Columbia Crew Survival Investigation Report. 


3.10.3.3. RESERVED 


3.10.4 Crew Interface Requirements 


A crew interface is any part of a system through which static and dynamic information is 
exchanged between the crew and the system. Crew interfaces can be hardware, software, 
procedures or any combination. Crew interfaces should be designed for usability and 
consistency. 


Usability optimizes crew safety and productivity. Usable interfaces are effective, efficient, and 
rated high on crew satisfaction. Usability is ensured through structured usability testing with 
crew, using representative hardware, software, procedures, and tasks. Objective data 
(completion times and errors) and subjective data (questionnaires, ratings, and 
comments/redesign recommendations) should be collected. 


Consistency minimizes design-induced errors and training requirements. Consistency should be 
assessed through use of heuristic evaluations and consistency scales. An example of consistency 
is a display standard that specifies the design characteristics of displays such as layout, style, 
color, size, fonts, etc. and standard icons and symbols. 


This section provides requirements for a broad category of design elements commonly referred 
to as “displays and controls.” A display is anything that provides visual, auditory, or haptic 
information to crewmembers (e.g., label, placard, procedure, software display, or auditory speech 
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or tone). A control is anything that accepts crewmember commands or inputs, whether hardware 
or software. In general, controls should be designed such that the shape and size do not hinder 
operation of the control itself. A human-centered design approach should be used to design the 
display and control layout to accommodate the user in the flight environment including any 
special considerations such as protective equipment worn by the crew. The comprehensive 
NASA standards for crew interface design can be referenced in JSC 65993, Commercial Human- 
Systems Integration Requirements (CHSIR), Section 10.0. 


A human-centered design approach, as referenced in Section 3.1 of JSC 65995, Commercial 
Human System Integration Processes (CHSIP), should be used to design the display and control 
layout to accommodate the user in the flight environment including any special considerations 
such as protective equipment worn by the crew. Additionally, guidance on design and evaluation 
of crew interfaces can be found in Section 4.12 of the CHSIP, and control and display panel 
labeling guidance can be found in Section 4.13 of the CHSIP. 


3.10.4.1_ Crew Interface Usability 


The spacecraft shall provide crew interfaces that have a minimum average satisfaction score of 
85 as measured by the System Usability Scale (SUS) in Appendix L. [R.CTS.138] 


Rationale: Crew satisfaction with the user interface is an essential component of the usability 
of the system. Satisfaction is commonly assessed by asking participants to rate various 
aspects of their perception of the system, such as ease of learning the system and frustration 
level. The SUS (Brooke, 1996) is a validated scale used to determine the subjective usability 
of and satisfaction with a system. The maximum score achievable is 100. The SUS can be 
found in Appendix L, Figure L.3-1. More detailed information on the system usability scale 
and crew satisfaction as a part of usability assessment can be found in Section 4.2 of JSC 
65995, Commercial Human Systems Integration Processes (CHSIP). Guidance on the crew 
task analysis process can be found in Section 4.1. 


3.10.4.2 Crew Interface Workload 


The spacecraft shall provide crew interfaces that result in Bedford Workload Scale ratings of 3 or 
less for nominal tasks and 6 or less for off-nominal tasks. [R.CTS.139] 


Rationale: Application of workload measurement for crew interface and task designs in 
conjunction with other performance measures (such as error rates) helps assure safe, 
successful, and efficient system operations by the crew. Workload assessments need to be 
performed continuously throughout the design process using multi-dimensional tools such as 
NASA-TLX as an integral part of human-centered design. Guidance on the assessment of 
workload during the design cycle and as part of verification can be found in Section 4.3 of 
JSC 65995, Commercial Human Systems Integration Processes (CHSIP), including Figure 
4.3.2.1-1, The Bedford Scale. Information on crew task analysis process can be found in 
Section 4.1. Workload can be decreased by modifying designs to use cues on interfaces, 
display information in groups, and arrangements that support task flow, and provide efficient 
display navigation. Evaluations of crew workload are required per NPR 8§705.2B, Section 
2.3.9. 
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3.10.4.3. Operability of Controls 


The spacecraft shall provide controls that are operable by a crewmember in their flight 
configuration. [R.CTS.340] 


Rationale: The proper design of controls is critical for successful spacecraft operation and 
mission success. Important features of control design include control shape, location, 
consideration of use environment (including accelerations, vibrations, and suited, 
pressurized operation), feedback, labeling (that is legible under use conditions), inadvertent 
actuation protection, display-control movement compatibility, and supports. These features 
enhance the crew's ability to successfully actuate controls in their use configuration and 
environment. In order to adequately design (displays and) controls, a human-centered design 
process must be implemented. A description of human-centered design process and 
principles can be found in Section 3.1 of JSC 65995, Commercial Human Systems 
Integration Processes (CHSIP). 


3.10.4.4 Design Induced Crew Errors 


The spacecraft shall provide crew interfaces that result in a maximum of 5% erroneous task steps 
per participant, where each erroneous task step is committed by 10% or fewer participants. 
[R.CTS.335] 


Rationale: For optimal safety and productivity, software and hardware crew interfaces must 
support crew performance with minimal errors. Errors may lead to significant timeline 
impacts or task failure; therefore errors can cause loss of efficiency, effectiveness, and 
satisfaction. An erroneous task step is defined as a task step with one or more design-induced 
errors. A design-induced error is an intentional action that does not reach its intended goal 
due to design issues. Examples of errors that may be design-induced include: missed or 
incorrect inputs or selections, display navigation errors, errors due to inadequate hardware 
component design, errors due to lack of system feedback to user inputs, errors due to design 
inconsistency or unfamiliar terminology, and inability to complete a task step. Recoverable 
design-induced errors still negatively impact crew performance in terms of time and 
satisfaction; thus, they are included in error calculations. Unintentional errors that are 
related to human reliability, that is, bumping a control due to fatigue, are not covered by this 
requirement. Usability assessments need to be performed throughout the design process and 
are an integral part of human-centered design. Usability evaluations are required per NPR 
8705.2B, Section 2.3.10. More detailed information on evaluating error rate as a part of 
usability assessment can be found in Section 4.2 of JSC 65995 CHSIP. Note that these error 
rate calculations are intended to reduce design-induced risk by encouraging iterative testing 
against error boundaries; statistical confidence increases with an increase in the number of 
subjects/tests. 


3.10.4.5 Emergency Annunciations 


The spacecraft shall provide visual and auditory annunciations to the crew for emergency, 
warning, and caution events per Section 9.4.4.3 of SSP 50005, International Space Station Flight 
Crew Integration Standard. [R.CTS.142] 


Rationale: Off-nominal events are divided into the following three categories: emergencies, 
warnings, and cautions. Distinct audio annunciations and visual indications should be 
utilized for each class and made consistent between the ISS and spacecraft throughout the 
mission to simplify training and improve user comprehension. Section 9.4.4.3 defines off- 
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nominal events for these categories, including priority and annunciation, for each alert 
type. The use of both visual and auditory sensory modalities is provided for redundancy. 


3.10.4.6 Annunciator Test 


The spacecraft shall test for a failure of the visual and auditory annunciators on request. 
[R.CTS.143] 


Rationale: Situational awareness and safety require a capability to test the Caution and 
Warning system. The crew must be aware as soon as possible when the Caution and 
Warning annunciation system cannot be relied upon. Examples include a light test or smoke 
alarm test button. 


3.10.4.7 Protect for Inadvertent Operation 


The spacecraft shall protect against inadvertent operation of controls. [R.CTS.149] 


Rationale: This requirement allows for the design to preclude inadvertent operation. For 
example, accidental activation by bumping can be prevented by the use of guards, covers, 
and physical separation from other controls. Accidental activation of commands using a 
computer display can be prevented with an "arm-fire" mechanism. This requirement is not 
intended to prevent operators from initially selecting the wrong control. The system needs to 
ensure the crew can recover from inadvertent input with minimal impact by incorporating 
the capability for undoing control input. 


3.10.4.8 Annunciator Intelligibility 


3.10.5 


The CTS shall utilize an auditory speech annunciator or communications system that provides a 
level of speech intelligibility equivalent to a 90% word identification rate under expected 
ambient noise levels for all phases of flight. [R.CTS.119] 

Rationale: This requirement ensures that auditory speech annunciations and 

communications are sufficiently salient and intelligible. ANSI S3.2-2009, American National 
Standard Method for Measuring the Intelligibility of Speech over Communicating System is a 
widely accepted standard for measuring the intelligibility of speech communications. 


Acoustics 


3.10.5.1 Acoustics Limits for Launch, Entry, and Abort 
3.10.5.1.1 24-Hour Noise Exposure Limit 


The CTS shall limit the noise exposure at the crewmember's ear, calculated over any 24-hour 
period, to 100% or less during launch and entry including ascent abort. The 24-hour noise dose, 
D, is calculated by: 


XC 
D=100) , 
n=l T, 

Where: 
N =the number of noise exposure events during the 24-hour period 
Cn= the actual duration of the exposure event in minutes 


Tn = the maximum noise exposure duration allowed, based on the specific sound level (Ln) 
of an exposure event in dBA, and calculated using the following equation: 
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480 


= FEB 


[R.CTS.228] 


Rationale: A noise dose of D=100 is equivalent to an 8-hour, 85 dBA time-weighted average 
(TWA) using a 3-dB exchange rate. Equivalent noise exposure levels above 85 dBA for more 
than 8 hours have been shown to increase the risk of noise-induced hearing loss. The above 
formulae can be used to calculate the 24-hour noise exposure levels based on the 8-hour 85 
dBA criterion recommended by National Institute for Occupational Safety and Health 
(NIOSH), using the 3-dB trading rule. 


3.10.5.1.2 Launch/Entry SPL Limit 


The CTS shall limit the maximum A-weighted overall SPL at the crewmember's ear to 105 dBA 
or less during launch and entry, and 115 dBA or less during ascent abort. [R.CTS.229] 


Rationale: Noise levels above 115 dBA have been shown to produce noise-induced hearing 
loss. In cases where audio communications are required (such as during launch and entry), 
a 105 dBA limit is required to allow 10 dB of headroom for alarms and voice 
communications. 


3.10.5.1.3 Impulse Noise Limit - Ear 


The CTS shall limit impulse noise at the crewmember's ear to less than 140 dB peak overall SPL 
during launch and entry including ascent abort. [R.CTS.230] 


Rationale: Impulse noise is a burst of noise that is at least 10 dB above the background noise 
and exists for one second or less. A limit of 140 dB peak SPL for impulse noise prevents 
trauma to the hearing organs caused by impulse noise (MIL-STD-1474D Department of 
Defense Design Criteria Standard, Noise Limits). 


3.10.5.1.4 Infrasonic Noise Limit 


The CTS shall limit infrasonic overall SPL at the crewmember's head location for frequencies 
from 1 to 20 Hz to less than 150 dB. [R.CTS.231] 


Rationale: The 150-dB limit for infrasonic noise levels in the frequency range from I to 20 
Hz provides for health and well-being effects. The noise attenuation effectiveness of hearing 
protection or communications headsets may not be used to satisfy this requirement, Ref. : 
2001 American Conference of Governmental Industrial Hygienists, Threshold Level Values 
(TLVs), "Infrasound and Low-Frequency Sound." 


3.10.5.2 Acoustic Limits for the Orbit and Post-Landing Phases 


The noise attenuation effectiveness of hearing protection or communications headsets may not be 
used to satisfy the following requirements: Q.1.2 and Q.1.3 


3.10.5.2.1 Noise level for Communication 
The spacecraft shall limit the Sound Pressure Levels to enable effective crew communication. 


a. The assessed SPLs shall be created by the sum of all simultaneously operating equipment 
including active Payloads and Government Furnished Equipment throughout the crew 
habitable volume. 
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b. The SPLs averaged over any 20-second measurement period shall be limited to the values 
given by the Noise Criterion (NC)-52 curve shown in Figure 3.10.5.2-1 and Table 3.10.5.2-1 
during all mission phases except launch, entry, and aborts. 


c. This limit does apply to intermittently operated hardware, unless the hardware is specified in 
the intermittent noise requirement Q.1.2. [R.CTS.342] 


Rationale: The intent of this requirement is to limit noise levels within the crew-habitable 
volume to allow for adequate voice communications and habitability during the onorbit 
mission operations. Limiting background noise, intermittent noise, narrow band SPL and 
providing audio volume control contributes towards enabling effective crew 
intercommunications. NC-52 limits noise levels within the crew-habitable volume to allow 
adequate voice communications and habitability during onorbit mission operations. The 
noise limit at 16 kHz does not appear in Figure 3.10.5.2-1, but is given in Table 3.10.5.2-1. 
In addition to the above background noise requirement, limiting intermittent noise, narrow 
band SPL and providing audio volume control also contribute towards enabling effective 
crew intercommunications. 
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Figure 3.10.5.2.1-1: NC Curves 
Note: Corresponding A-weighted SPLs and speech interference levels (SILs) are given for 
reference only (Beranek, L.L; Ver, I. L. (1992). Noise and Vibration Control 
Engineering, Principals and Applications, Chapter 17. John Wiley and Sons.) SIL (4) 
is Speech Interference Level, 4-band method. 
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Table 3.10.5.2.1-1: Octave Band SPL Limits for Continuous Noise, dB re 20 wPa 


Octave 
Band 
Center 
Frequency 


Work 
Areas 


3.10.6 Radiation 


3.10.6.1 Ionizing Radiation 


The radiation sources in space, Galactic Cosmic Radiation (GCR), trapped particle radiation, and Solar 
Particle Events (SPEs), have distinct physical and biological damage properties compared to terrestrial 
radiation, and thus require distinct methods to project and mitigate risks. In addition, all use of 
radioactive material (for example in auto-illumination or as a check source) or ionizing radiation- 
producing devices require adherence to established safety review and authorization 
procedures/constraints for NASA flight approval. Astronauts have been classified as radiation workers, 
and processes exist to protect them from excessive radiation exposure by keeping exposures As Low as 
Reasonably Achievable (ALARA). 


3.10.6.2 Radiation Design 
3.10.6.2.1 Radiation Protection 


The CTS shall provide an assessment of protection from radiation exposure to ensure that 
effective dose (tissue averaged) to any crewmember is consistent with ALARA principles. 
[R.CTS.239] 


Rationale: The ALARA principle is a legal requirement intended to ensure astronaut safety. 
An important function of ALARA is to ensure that astronauts do not approach radiation 
limits and that such limits are not considered "tolerance values." ALARA is an iterative 
process of integrating radiation protection into the design process, ensuring optimization of 
the design to afford the most protection possible, within other constraints of the vehicle 
systems. The protection from radiation exposure is ALARA when the expenditure of further 
resources would be resource prohibitive by the reduction in exposure that would be 
achieved. The assessment should include exposure from the use of radioactive isotopes and 
radiation producing equipment onboard the spacecraft. Guidance on radiation design 
considerations and methods of assessment can be found in Section 4.8 of JSC 65995, 
Commercial Human System Integration Processes. When performing assessment, ISS design 
requirements for ionizing radiation protection can be found in Section 5.7.2.2.2 of SSP 
50005 International Space Station Flight Crew Integration Standard to aid in evaluating the 
protection from radiation exposure. 


Radiation protection for humans in space differs from that on Earth because of the distinct 
types of radiation, the small population of workers, and the remote location of astronauts 
during space flight. The definition of the worker population (NASA astronaut population) is 
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incorporated into the design limit. The radiation sources in space, GCRs, trapped particle 
radiation, and SPEs have distinct physical and biological damage properties compared to 
terrestrial radiation, and the spectrum and energy of concern for humans differs from that 
for electronics. Radiation protection for the crew must consider this environment and these 
concerns. Nominal mission exposure will be covered by a legal limit. See 10 CFR 20.1003 
[Title 10 — Energy; Chapter I -- Nuclear Regulatory Commission; Part 20 -- Standards for 
Protection Against Radiation; Subpart A -- General Provisions] 


3.10.6.3 Non-Ionizing Radiation 


Sources of non-ionizing radiation are present in space flight applications, and exposure is potentially 
hazardous to crewmembers. Astronaut occupational exposure to non-ionizing radiation is managed 
through mission architecture, system design, procedures and planning, and application of appropriate 
countermeasures. This document classifies non-ionizing radiation into three categories: radio frequency 
(RF) radiation, lasers, and incoherent electromagnetic radiation. 


3.10.6.3.1 RF Non-Ionizing Radiation Exposure Limits 


The CTS shall protect the crew from exposure to RF radiation to the limits as shown graphically 
in Figure 3.10.6.3.1-1. [R.CTS.241] 


Rationale: These limits were modified from IEEE C95.1, Safety Levels with Respect to 
Human Exposure to Radio-Frequency Electromagnetic Fields, 3 kHz to 300 GHz, to remove 
an excessive factor of safety in the power density limit for general populations, including 
children. Design requirements cover exposure to RF radiation for the duration of a mission. 
Limits are intended to establish exposure conditions for RF and microwave radiation to 
which it is believed that nearly all workers can be repeatedly exposed without injury. 
Hazard analysis is necessary to identify potential sources of non-ionizing radiation exposure 
according to planned vehicle operations. Contributions of combined sources from the 
vehicle, hand-held devices, and other vehicles in proximity need to be considered. Exposure 
duration must also be considered. Exposure can be limited by eliminating or controlling RF 
sources, establishing appropriate keep-out zones, or controlling length of exposure. 
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Figure 3.10.6.3.1-1: RF Electromagnetic Field Exposure Limits 
(Illustrated to show whole-body resonance affects around 100 MHz) 
(Modified from IEEE C95.1) 


Table 3.10.6.3.1-1: RF Electromagnetic Field Exposure Limits 
(Modified from IEEE C95.1) 


Frequency RMS RMS Magnetic | RMS Power Density Averaging Time ” 
Range Electric | Field Strength (S) IEP, |H?, or S 
(MHz) Field (H)* E-Field, H-Field (min) 

Strength (A/m) (W/m?) 
(E)? 
(V/m) 
0.1 — 1.34 614 16.3/fu (1,000, 100,000/f°)° 6 6 
134-3 823.8/fu 16.3/fu (1,800/fuz, 100,000/fxz) | fxr/0.3 6 
3-30 823.8/fu 16.3/fu (1,800/fuz, 100,000/f x2) 30 6 
30 - 100 27.5 158.3/fyy (2, 9,400,000/f u3*°) 30 0.0636 f "337 
100 - 300 27.5 0.0729 2 30 30 
300 - 5000 - - f/150 30 
5000 - 15000 = 2 7/150 150/fc 
15000 — 30,000 — — 100 150/fe 
30,000 — 100,000 — — 100 25.24/f ¢°” 
700,000 — 300,000 i 7 700 5048/[(9fc-700) fo”? 


Commercial Crew Program 


International Space Station Program 


Page 90 of 295 


ISS Crew Transportation and CCT-REQ-1130 
Services Requirements Document Revision: E-1 


Note: fuis the frequency in MHz; fais the frequency in GHz. 


(a) For exposures that are uniform over the dimensions of the body, such as certain far-field plane- 
wave exposures, the exposure field strengths and power densities are compared with the MPEs in the 
table. For non-uniform exposures, the mean values of the exposure fields, as obtained by spatially 
averaging the squares of the field strengths or averaging the power densities over an area equivalent 
to the vertical cross section of the human body (projected area), or a smaller area depending on the 
frequency are compared with the MPEs in the table. For further details, see IEEE C95.1, notes to 
Table § and Table 9. 


(b) The left column is the averaging time for |E|?; the right column is the averaging time for |H|?. For 
frequencies greater than 400 MHz, the averaging time is for power density (S). 


(c) These plane-wave equivalent power density values are commonly used as a convenient 
comparison with MPEs at higher frequencies and are displayed on some instruments in use. 


3.10.6.3.2 Laser Exposure Limits 


The CTS shall protect the crew from exposure to lasers in accordance with the limits in ANSI 
Z136.1-2007, American National Standard for Safe Use of Lasers for limiting skin and ocular 
exposure to both continuous wave and repetitively pulsed lasers without protective equipment. 
[R.CTS.242] 


Rationale: Contributions of combined sources from the vehicle, hand-held devices, and other 
vehicles in proximity need to be considered. Examples include docking lasers combined with 
the use of cameras on another vehicle. Design requirements are to cover exposure to both 
continuous and repetitively pulsed lasers to protect against skin and ocular injury. Tables 5a 
and Sb in ANST Z136.1-2007, American National Standard for Safe Use of Lasers apply to 
ocular exposure and Table 7 applies to dermal exposure. This requirement applies to lasers 
used both internal and external to the spacecraft. 


3.10.6.4 Incoherent Electromagnetic Radiation 
3.10.6.4.1 Retinal Thermal Injury from Visible and Near Infrared Source 


The spacecraft shall protect the crew from retinal thermal injury from visible and near infrared 
sources by limiting exposure to spectral radiance per Section I.1 in Appendix I. [R.CTS.244] 


Rationale: This requirement is intended to prevent retinal thermal injury from visible and 
near-infrared sources with wavelengths between 385 and 1,400 nm. 


3.10.6.4.2 Visible Radiation Limits 
The spacecraft shall protect the crew from visible radiation sources by limiting the spectral 
radiance per Sections I.2 and I.3 in Appendix I. [R.CTS.245] 
Rationale: This requirement is intended to prevent retinal photochemical injury from 
exposure to visible-light sources with wavelengths between 305 and 700 nm. The sun is 


considered a small source since it subtends an angle of approximately 9 milliradians when 
observed from earth. 
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3.10.6.4.3 Thermal Injury from Infrared Radiation 


The spacecraft shall protect the crew from thermal injury from infrared radiation by limiting the 
spectral irradiance of the crew per Section I.4 in Appendix I. [R.CTS.246] 


Rationale: This requirement is intended to prevent ocular injury caused by overexposure to 
infrared radiation, including delayed effects to the lens (such as cataractogenesis.) 


3.10.6.4.4 Ultraviolet (UV) Exposure for Unprotected Eye or Skin 


The spacecraft shall protect the crew from UV exposure for unprotected eyes and skin by 
limiting the spectral irradiance per Section I.5 in Appendix I. [R.CTS.247] 


Rationale: This requirement is intended to prevent ocular and dermal injury caused by 
overexposure to UV radiation. A table of weighted spectral irradiances versus permissible 
exposure times is given in Appendix I for discrete irradiances for reference. 


Mitigation Rationale to Non Ionizing Radiation (NIR): Any exposure to NIR must consider 
the entire pathway of the incident radiation prior to its interaction with a crewmember's 
body, including any concentration, diffusion, or filtering. For example, concentration of 
source radiation by optical instruments and attenuation by vehicle window systems need to 
be considered when evaluating the final radiation incident upon the crewmember. 
Protection from NIR may be accomplished through the reduction of effective irradiance or by 
limiting exposure times. Any means of providing NIR protection must not permanently 
degrade the ability of any optical systems including windows to perform their intended 
function. The transmittance required for windows, visors, and other optical devices can be 
reconciled with protection from NIR through the use of temporary filters, proper material 
selection, apertures, beam stops or splitters, or other appropriate means. 


3.10.7 RESERVED 
3.10.8 RESERVED 
3.10.9 RESERVED 


3.10.10 Operational Limitations 
This section provides requirements for operational limits that affect CTS architecture design. 
These operational constraints are considered during the design phase in order to develop an 
architecture that satisfies these operational requirements during actual missions. 

3.10.10.1 Crew Awake Period 


The CTS shall require all nominal crew activities to occur during a crew-awake period of 16 
hours or less on any free flight day except landing day, including: 


1 hour post-sleep and 1 hour pre- sleep to transition between sleep and work activities. 


b. 30 continuous minutes per meal for consumption, with additional continuous time for meal 
preparation, for 3 meals a day. 


c. Crew sleep scheduled no earlier than 3 hours after launch. 


d. Any nominally planned docking or undocking/separation operations shall not begin prior to 
post-sleep and breakfast. [R.CTS.108] 
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Rationale: A definition of a nominal crew awake period is required for planning and 
scheduling of the crew activities to meet mission objectives and to avoid crew fatigue and the 
resulting performance degradation. Free flight days include launch day and onorbit days 
where the spacecraft is not mated to the ISS for the full crew day. The total crew awake 
period is derived from existing requirements for NASA astronauts based on Apollo, Shuttle, 
and ISS experience. When meals, personal hygiene, and other time allocations are factored 
in, the effective time for mission related tasks is around 12 hours. 


Time, referred to as pre and post-sleep, is to be allocated before crew sleep and after crew 
wake to allow the crew to transition between sleep and work related activities and to perform 
personal hygiene activities. The minimum time of one hour is based on the time required to 
transition between sleep and work related activities. Additional pre and post-sleep time 
above the one hour minimum may be required to accommodate hygiene activities for all crew 
depending on the number of crew and hygiene system. Pre and post-sleep timeframes do not 
include time for review/study in preparation for the day's activities, daily maintenance, 
payload science, or other spacecraft reconfiguration activities. The appropriate duration for 
maintenance and reconfiguration will depend on the vehicle design and the review/study time 
will be commensurate with the complexity and content of the day's activities. 


The minimum time after crew wake before initiating complicated orbital operations, such as 
docking, allows time for hygiene and minimal meal activities and allows for acceptable 
cognitive performance before initiating complicated activities. Ideally 3 hours after crew 
wake is desired to ensure peak performance. On the day of launch (the crew day includes 
pre-launch activities), if the crew day duration onorbit is less than 3 hours, the crew may not 
be properly adjusted to the space environment when scheduled to sleep. 


Meals will be allocated near the beginning, middle, and end of each day. The time required 
to prepare meals will depend on the design of the food system. 


3.10.10.2 Landing Day Crew Awake Period 


The CTS shall require all nominal crew activities to occur during a crew-awake period of 18 
hours or less on landing day, inclusive of 6 hours post-egress for medical exam, hygiene/meal 
activities and baseline data collection for NASA sponsored crew. 


a. 1 hour post-sleep to transition between sleep and work activities. 


b. 30 continuous minutes per meal for consumption, with additional continuous time for meal 
preparation. 


c. Any nominally planned deorbit operations shall not begin prior to post-sleep and breakfast. 
[R.CTS.347] 


Rationale: Post-egress activities assume 1 hour for crew transportation and 5 hours for a 
combination of 4 hours of medical exam (baseline data collection) and 1 hour for 
hygiene/meal activities. The NASA Flight Surgeons will determine the suitability of any 
crewmember to participate in the post flight testing. 


3.10.10.3 Crew Sleep Period 


The CTS shall provide for a minimum of 8 continuous hours of crew sleep for all crew at the 
same time on any free flight day. [R.CTS.320] 
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Rationale: To maintain circadian rhythm, a crewmember should be awake for 16 hours and 
sleep for § hours. If the sleep period is less than § hours, the crew will not receive enough 
rest. The sleep period for all crew must be scheduled at the same time since cabin size and 
configuration is not expected to be able to support sleep for a portion of the crew while other 
crewmembers are awake. 


3.10.10.4 Crew Limits in Launch Orientation 


The CTS shall not allow any crew to be on their back with feet elevated in a launch configuration 
for longer than 5 hours, excluding subsequent safing and egress time. [R.CTS.348] 


Rationale: This position can be extremely fatiguing and cause musculoskeletal discomfort, 
which can affect cognitive performance and impairs crewmembers’ ability to perform launch 
duties and emergency egress procedures. The time interval ends with liftoff. 


3.10.11. Internal Atmosphere 
3.10.11.1 General 
3.10.11.1.1 Habitability Limits 


The spacecraft shall maintain a habitable environment within the limits of Table 3.10.11.1.1-1 
throughout all flight phases except during quiescent docked operations and post-landing. 
[R.CTS.346] 


Rationale: The spacecraft is to be designed to operate within the specified limits to ensure 
crew health and performance during the mission. Limits are derived from Space Flight 
Human Systems Standard, NASA-STD-3001, Volume 2: Human Factors, Habitability, and 
Environmental Health. This requirement is not applied during quiescent docked operations, 
as SSP 50808 requirements are applicable in that phase. This requirement does not apply 
in-total post-landing, as requirement 3.5.1.4, “Post-Landing Crew Services,” is applicable in 
that phase. 
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Table 3.10.11.1.1-1: Atmospheric Habitability Limits 


Parameter Nominal Nominal Rationale 
Minimum Maximum 


The intent of the requirement is for the spacecraft to 
be designed to operate nominally within the 
specified cabin pressure range to ensure crew health 
and performance during the mission. The 
spacecraft should be able to maintain the specified 
pressure around 101.35 kPa (14.7 psi) throughout 
all mission phases except quiescent docked 
96.5 kPa 102.7 kPa operations. The crew cabin pressure of 101.3 kPa 
(14.0 psia) (14.9 psia) (14.7 psi), consisting mainly of an atmosphere of 
nitrogen and to a lesser extent oxygen, is a standard 
operating pressure for recently designed NASA 
spacecraft (Space Shuttle during non-EVA 
operations, SpaceLab, and ISS) to provide optimal 
cooling for air cooled avionics, payloads, and other 
equipment in addition to meeting crew life support 
needs. 
The spacecraft shall maintain oxygen partial 
pressure to the specified range throughout all 
mission phases except quiescent docked operations. 
The ranges/limits provided above are nominal 
physiological values for indefinite human exposure 
without measurable impairments to health or 
performance and is the range that ISS operates 
within. The nominal ppO2 pressure for the Space 
Shuttle during non-EVA operations and SpaceLab 
is between 20.3 kPa (2.95 psi) and 23.7 kPa (3.45 
psi) for a cabin pressure of 101.35 kPa (14.7 psi). 
These limits are driven by ISS cargo and are well 
within the physiological limits of the crew, 
however, it is expected that pressure changes will 
be effected more slowly than this where possible. 
The spacecraft shall limit exposure of the crew and 
cargo to the specified rate of change in order to 
prevent injury to the crew's ears and lungs and to 
avoid damage to cargo during depressurization and 
re-pressurization. 


a. Cabin Pressure 


19.4 kPa 22.7 kPa 


b. Cabin ppO2 (2.82 psia) (3.3 psia) 


Depress: 890 
pa/sec 
(CHS 
No psi/min) 
Minimum Repress: 800 
Pa/sec 
(6.96 
psi/min) 


c. Cabin 
Depress/Repress 
Rates 
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Parameter Nominal Nominal Rationale 
Minimum Maximum 


The ranges/limits provided in this requirement are 
nominal physiological values for indefinite human 
exposure without measurable impairments to health 

d. Cabin ppCO2 No 4.0 mmHg or performance. Spacecraft CO2 sensors may report 

; Minimum (0.077 psia) | values lower than the inhaled atmosphere, so 

precautions must be taken to ensure that local 
(relevant to crewmember's face) CO2 does not 
exceed the limit. 


The temperature limits in this requirement protect 
for human comfort (and thus performance) without 
the use of thermal protective garments resulting in 
this narrow temperature range. The comfort zone is 
defined as the range of environmental conditions in 
which humans can achieve thermal comfort and not 

e. Cabin so 1S 26.7 °C have their performance of routine activities affected 

Temperature (65 °F) (80 °F) by thermal stress. Thermal comfort is affected by 
the work rate, clothing, and state of acclimatization. 
If the crew is isolated from the cabin air due to 
wearing a pressure suit the cabin air temperature 1s 
then controlled by the air temperature requirement 
for the actively cooled payload requirement that can 
be found in SSP 50833. 


The spacecraft must maintain average humidity 
above the lower limits stated to ensure that the 
environment is not too dry for the nominal 
functioning of mucous membranes. If humidity is 
not maintained above the lower limits, additional 
: : rmu rovided to the crew to prevent 
f. Cabin Relative pened Pep a : ns 
nee 25% dehydration. Humidity must be maintained below 

Humidity ae 
the upper limits for crew comfort, to allow for 
effective evaporation, and to limit the formation of 
condensation. Also, a humidity level below 25% 


relative humidity increases the risk of charge build 


up on equipment in the cabin and there is an 
increased electrostatic discharge (ESD) concern. 


Commercial Crew Program 
International Space Station Program Page 96 of 295 


ISS Crew Transportation and CCT-REQ-1130 
Services Requirements Document Revision: E-1 


Parameter Nominal Nominal Rationale 
Minimum Maximum 


Crew and equipment give off heat, moisture, and 
CO} that will lead to parameters outside the bounds 
of environmental requirements if adequate 
ventilation is not provided. Maintaining proper 
ventilation within the internal atmosphere is 
necessary to ensure that stagnant pockets do not 
form, and the temperature, humidity, and 


g. Cabin atmospheric constituents are maintained within 


4.6 m/min 36.6 m/min 


Velocities for their appropriate ranges. Lower values to those in 


(15 ft/min) (120 ft/min) 
[bulk] [bulk] 

2.1 m/min 60.9 m/min 
(7 ft/min) (200 

[Min] ft/min)[Max] 


Mixing 

(66% of bulk 
time-average 
velocity/minimum 
velocity) 


this requirement have been used on the Space 
Shuttle and ISS, but similar values are being 
proposed for Orion. See JSC 65993, Commercial 
Human-Systems Integration Requirements, CH6008 
for rationale pertaining to values. 


Note: The measurements for this requirement 
exclude any area that is 15.2 cm (6 in) or less from 
the walls of the crew habitable cabin. It also 
excludes any area that is 7.6 cm (3 in) or less from 
avionics/secondary structure permanently in the 
crew habitable cabin, and seats. 


3.10.11.1.2 Cabin Pressure Maintenance during Leak 


The spacecraft shall maintain the habitable pressurized volume at no less than 55.2 kPa (8.0 psia) 
for the time required to execute a deorbit and landing in the event of a cabin leak with an 
equivalent hole diameter of 0.64 cm (0.25 in). 


a. The life support system shall provide consumables for the entire crew during this time frame. 


b. The spacecraft deorbit entry and landing systems shall be fully operable down to a cabin 
pressure of 55.2 kPa (8.0 psi). [R-CTS.153] 


Rationale: This requirement defines the spacecraft response to a cabin leak or a structural 
breach in the cabin. The life support system must feed the leak for a discrete amount of time 
to allow the crew to execute a deorbit and landing. In this scenario, the spacecraft systems 
must be able to operate in a 55.2 kPa (8.0 psi) environment particularly from an avionics 
cooling perspective. The 0.64 cm (0.25 in) hole is derived from expected leak rates from lost 
seals on overboard hatches and feed-throughs based on previous human space flight 
experience for relatively small crew volumes. 


3.10.11.1.3 Return Contaminated Atmosphere within Limits 


The spacecraft shall return the pressurized volume to a habitable environment as prescribed in 
Table 3.10.11.1.1-1 and meet the contamination limits prescribed in Table 3.10.11.1.3-1 
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following the contamination of the cabin atmosphere following a fire, or toxic chemical release 
when the hatch is closed. [R.CTS.152] 


Rationale: A contamination event due to a fire or toxic chemical release should not 
automatically cause long-term contingency operations that threaten crew health. Methods 
for cleaning the crew cabin include a cabin purge system to eliminate the contaminated 
atmosphere by venting the gas overboard and/or systems that are able to scrub the 
contaminants from the atmosphere through a filtration system. 


Table 3.10.11.1.3-1: Post-Fire and Contamination Event Limits 


200 ppm 


HCl 5 ppm 

7-day SMAC values prescribed in JSC 
All Other 20584 Spacecraft Maximum Allowable 
Contaminants | Concentrations (SMAC) 


3.10.11.1.4 Protect for Atmospheric Contingency 


The spacecraft shall provide oxygen and nitrogen storage consumables sufficient to survive from 
the larger of two contingency scenarios: 


a. Purge and return to habitable environment following contamination of the cabin atmosphere 
per 3.10.11.1.3, or 


b. Feed a cabin leak per 3.10.11.1.2. [R.CTS.154] 


Rationale: Oxygen and nitrogen consumables must be allocated to respond to cabin pressure 
events. The contaminated atmosphere event includes consumables for emergency breathing 
for all crewmembers and a single cabin depress/repress if that is the method utilized to scrub 
the cabin atmosphere from contaminants. The unrecoverable cabin leak scenario includes 
consumables required to maintain cabin at 55 kPa (8 psia) until a deorbit burn can be 
executed and the vehicle reaches an altitude where the crew is able to survive utilizing the 
atmosphere exterior to the spacecraft. The consumables storage systems must be designed to 
protect for the largest amount of consumables of these two scenarios, but it is unreasonable 
to assume that both occur during the same mission. 


3.10.11.2 Detailed Pressurized Crew Cabin Requirements 
3.10.11.2.1 Crew Atmospheric Control 


The system shall provide crew control of temperature and ventilation within the limits defined in 
3.10.11.1.1 throughout all flight phases except during quiescent docked operations. [R.CTS.157] 
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Rationale: The spacecraft is to provide the specified capability for crew control of habitable 
volume atmospheric parameters and set-points throughout all operations mission phases 
except quiescent docked operations. The ability to control local cabin ventilation by 
adjusting the direction of air flow enables the crew to prevent exhaled, CO2-rich air from 
building around the head and to prevent drying of facial mucous membranes. To provide 
crew capability to control atmospheric parameters, the vehicle must measure and display 
current parameters to the crew. Crew Control is also necessary to enable crew intervention 
in contingency scenarios specifically for crew overheating and mitigating the effects of Space 
Adaptation Syndrome. 


3.10.11.2.2 O2 Limit 


The spacecraft shall limit oxygen concentration within the pressurized cabin to 24.1% by volume 
or less from a nominal cabin pressure per Table 3.10.11.1.1-1 to a cabin pressure of 7OkPA 
(10.2psia). [R.CTS.166] 


Rationale: Spacecraft cabin and crew support materials are required to be compatible (non- 
fire-propagating) with 24.1% O2 concentration based on the certification of the ISS. 


3.10.11.2.3 O2 Limit during Depressurization 


The spacecraft shall maintain the oxygen levels in the cabin within the following range during a 
cabin depressurization event when the cabin pressure is between 70 and 55 kPa (10.2 and 8.0 
psia): 

a. Greater than 17 kPa (2.4 psia) partial pressure of oxygen, and 

b. Less than 30% oxygen concentration. [R.CTS.167] 


Rationale: Spacecraft cabin and crew support materials are required to be compatible (non- 
fire propagating) at pressurized volume oxygen percentage up to 30% during a cabin 
depressurization based on the current data for the certification of the materials at reduced 
pressures for the Space Shuttle and the ISS Airlock. This is a hypoxic atmosphere and 
therefore will result in reduced crew performance and judgment to non-acclimatized 
individuals if the crewmember is breathing cabin air. Allowing a level of ppO2 lower than 
Table 3.10.11.1.1-1 is acceptable since supplemental oxygen is available to the crew by mask 
and from the pressure suit. 


3.10.11.2.4 Accommodate Metabolic Loads 


The spacecraft shall accommodate crew metabolic loads provided in Appendix F - Metabolic 
Loads during all flight phases. [R.CTS.312] 


Rationale: Metabolic load data allows the Environmental Control and Life Support Systems 
(ECLSS) engineers to properly size the ECLSS system. Metabolic loads, in conjunction with 
the operational concept, provide an upper bound for oxygen (O2) demand, carbon dioxide 
(CO2) production, and heat rejection requirements. This information is vital for all 
spacecraft ECLSS designs. Appendix F provides a short description of the loads provided 
along with the assumptions used in the analysis. Guidance on the use of metabolic load data 
in the design process can be found in Section 4.11 of JSC 65995. 
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3.10.12 Contamination 
3.10.12.1 Measure Toxic Combustion Products 


The CTS shall report real time to the crew the concentration of toxic products to within the 
accuracies identified in Table 3.10.12.1-1 for carbon monoxide (CO), hydrogen cyanide (HCN), 
and hydrogen chloride (HCl). [R.CTS.182] 


Rationale: Because of the extreme danger from combustion in a spacecraft, real time 
combustion product monitoring and display are required to provide awareness to the crew in 
order that appropriate decisions can be made and actions taken to maintain health and 
safety (e.g., donning or doffing masks to provide contingency breathing capability). Real 
time monitoring is not restricted to continuous, vehicle-integrated monitoring, but must be 
readily available and activated quickly enough to provide operationally relevant data to 
facilitate informed decision making by the crew and ground-support staff in response to the 
hazard. 


Table 3.10.12.1-1: Toxic Product Concentration Accuracies 


CO 5-500 For values from 50 to 500 ppm + | For values from 5 to 50 ppm 
10% + 20% 


20% + 25% 
+25% +25% 


3.10.12.2 Use of Hazardous Chemicals 


The CTS shall use chemicals that are Toxic Hazard Level 3 or below in the spacecraft habitable 
volume, as defined in JSC 26895, Guidelines for Assessing the Toxic Hazard of Spacecraft 
Chemicals and Test Materials. No compound that could decompose to a Toxicological Hazard 
Level 4 shall be used. [R.CTS.183] 


Rationale: Toxic hazard Level 4 compounds can pose an immediate risk to crew health and 
can cause permanent injury. They cannot be cleaned up by the crew and may not be 
scrubbed from the environment by the ECLSS system. 


3.10.12.3 Gas Pollutant Limits 


The spacecraft shall limit gaseous pollutant accumulation in the habitable atmosphere to below 
1.0 T unit during all mission phases based on the length of crew exposure according to the 
individual chemical compound concentration limits established in JSC 20584, Spacecraft 
Maximum Allowable Concentrations for Airborne Contaminants. 


a. The spacecraft shall limit accumulation of pollutants in the habitable volume produced by 
metabolic loads and spacecraft system sources to 0.5 T units or less based on 7-day SMACs 
with the air revitalization system operating. 
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b. The spacecraft shall limit accumulation of pollutants in the habitable volume produced by the 
load of equipment off-gassing to 0.5 T units or less based on 7-day SMACs with the air 
revitalization system operating. [R.CTS.184] 


Rationale: Airborne exposure limits for individual trace chemical contaminants and methods 
for assessing trace contaminant mixtures in a crewed cabin atmosphere are defined to 
protect crewmembers from illness and injury. The Spacecraft Maximum Allowable 
Concentrations (SMACs) provide guidance for short-term (1 and 24 hours), medium-term (7 
and 30 days), and long-term (180 days and 1000 days) exposure of individual trace chemical 
contaminants. Short-term SMACSs are designated as emergency SMACs and are intended to 
be used in emergency situations, such as accidental spills or fire. Medium and long-term 
SMACSs are guidance levels intended to avoid adverse health effects, either immediate or 
delayed, and to avoid degradation in performance of crew after continuous exposure for the 
designated duration. The SMACs also take into account unique factors for human space 
flight including the stress on human physiology and uniform good health of astronauts and 
the absence of pregnant or very young individuals. The trace chemical contaminant load 
provided by Table 4.3.10.12.3-1 is a subset derived from JSC 20584, Spacecraft Maximum 
Allowable Concentrations for Airborne Contaminants, and SAE 2009-01-2592, A Design 
Basis for Spacecraft Cabin Trace Contaminant Control. The Table 4.3.10.12.3-1 load is used 
as the design basis until vehicle off-gassing test and vehicle system chemical release data 
become available at which time the equipment off-gassing and system generation data will 
supersede the Table 4.3.10.12.3-1 list. A toxic hazard, or T-unit, is a sum of the ratios of each 
predicted/measured pollutant concentration to the respective limit from JSC 20584. 


3.10.12.4 Particulate Control 


The spacecraft shall limit the concentration in the cabin atmosphere of particulate matter ranging 
from 0.5 um to 10 um (respirable fraction) in aerodynamic diameter to <1 mg/m3 and 10 um to 
100 um to <3 mg/m3. [R.CTS.185] 


Rationale: Inhalation of particulates can cause irritation of the respiratory system. Limits 
for particulates are based on Occupational Safety and Health Administration (OSHA) 
standards for nuisance dusts, which is the best analog for the ordinary dust present in 
spacecraft. This does not include reactive dust (e.g., LiOH). 


3.10.12.5 RESERVED 
3.10.12.6 Microbial Limits 


The CTS shall limit the levels of microbial contaminants in the spacecraft habitable volume by 
maintaining an average continuous flow of 566.33 liters per minute (20 cubic feet per minute) or 
greater per person of air that has been cleaned to have at least 99.97% of airborne particles 0.3 
um and larger in diameter/size removed. [R.CTS.187] 


Rationale: Microbial limits for breathing air are designed to prevent infection and allergic 
response. Requirements are based upon industrial hygiene recommendations for similar 
environments (American Society of Heating, Refrigerating and Air-Conditioning Engineers 
(ASHRAE-62)). Limitations on fungi and bacteria in spacecraft are consistent with previous 
requirements, such as SSP 50260, Revision C, ISS Medical Operations Requirements 
Document (ISS MORD). ISS air systems utilize High Efficiency Particulate Air (HEPA) filter 
design to provide clean air. These filters have performed exceptionally well in controlling 
atmospheric microbial concentrations. This requirement does not apply to suited operations. 
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3.10.12.7 RESERVED 
3.10.12.8 RESERVED 
3.10.12.9 Condensation Limits 


The CTS shall limit condensation persistence on interior surfaces to 1 hour per day within the 
spacecraft habitable volume throughout all flight phases except during quiescent docked 
operations. [R.CTS.190] 


Rationale: The system is to provide controls and mitigation steps to limit the formation of 
water condensate on internal surfaces, which has been demonstrated to promote growth of 
fungi, as this poses a hazard to crew health. These controls must consider pre-launch 
strategies until docking. Once docked to ISS, SSP 50808 sets condensation limits. Examples 
of moisture buildup from Mir and ISS missions that resulted in fungal growth include non- 
insulated cold surfaces and designed operations, which moisten surfaces (such as wetting a 
cloth) without appropriate drying. Condensation on a non-ventilated surface will be difficult 
to dry. 


3.10.12.10 RESERVED 

3.10.13 RESERVED 

3.10.14 Hatches and Doorways 

3.10.14.1 Hatch Bi-directional Operability 
Ingress/egress hatches shall be operable from both the inside and outside the spacecraft by a 
single person during all flight phases when the hatch is used. [R.CTS.170] 


Rationale: In an emergency scenario, ingress/egress hatches should be simple enough to be 
operated by a single ground support team or flight crewmember. The hatch must also be 
opened and closed by a single crewmember from both inside and outside of the spacecraft. 


3.10.14.2 Hatch Windows 


The CTS shall provide a window on all sealable hatches for direct non-electric visual observation 
of the environment on the opposite side of the hatch. [R.CTS.174] 


Rationale: Direct visual observation of the environment on the opposite side of a hatch 
allows the crew to determine the conditions or obstructions, such as the presence of fire or 
debris, on the other side of the hatch for safety purposes. Visibility is also needed for ground 
crew viewing into the vehicle during pad operations and post-landing. Windows do not have 
the failure modes associated with cameras and display systems that may not be operable 
during emergencies when most needed. 


3.10.15 RESERVED 
3.10.16 | Crew Size, Mass, and Strength 
3.10.16.1 Anthropometric Dimensions Standards 


The CTS shall accommodate NASA crew anthropometric dimensions provided in Appendix D, 
Table D-1 and Table D-2 and applicable suit conditions. [R.CTS.193] 


Rationale: The design of physical items that interface with the crew must account for crew 
anthropometry and applicable suit conditions using a human centered design approach as 
referenced in Section 3.1 of JSC 65995, CHSIP. This includes hand controls, seat 
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dimensions, hatch opening size, the distance from the seat to controls, handle dimensions, 
and other similar items. An analysis of expected crew operations, activities, and tasks along 
with the anthropometric dimension data contained in Appendix D often drive the design of 
human-machine interfaces. Guidance on the evaluation of the design using anthropometric 
data can be found in CHSIP, Section 4.5. The provided anthropometry data is representative 
of the NASA astronaut corps and based on the 2009 anthropometric selection criteria for 
astronaut applicants as documented in JSC 64548 Anthropometric and Strength Selection 
Criteria for Astronaut Applicants. The critical anthropometric dimensions represent 
measurements commonly deemed as most important to consider for vehicle and suit design 
based on past experience. For example, seated height is a critical dimension for seat design 
because it ensures head clearance, while biacromial breadth is critical to a proper design of 
restraint straps. 


3.10.16.2 Crew Body Mass Standards 
The CTS shall accommodate crew body mass provided in Appendix D, Table D-3. 


a. It is acceptable to utilize Appendix D, Table D-4 when computing the crew cabin mass of a 
complement of crewmembers rather than using the maximum weight for each crewmember. 


b. Appendix D, Table D-6 contains the center of mass for the human body. 
c. Body segment mass can be found in Appendix D, Table D-5. [R.CTS.194] 


Rationale: Body mass data is important for various systems. Most importantly, body mass 
properties must be used for propulsion calculations and ensuring the structural integrity of 
human system interfaces. Propulsion and system dynamic calculations depend on accurate 
data for the full range of crewmember mass to size the propulsion system and design proper 
vehicle dynamic controls. Vehicle systems with human system interfaces are to be designed 
such that they will not be damaged after being subjected to the forces that a crewmember can 
impart on that interface during acceleration. As an example, body support systems (e.g., 
seats, brackets, and restraints) must accommodate forces exerted by a crewmember, under 
all anticipated acceleration and gravity environments. Guidance on the evaluation of design 
using mass properties data can be found in Section 4.5 of JSC 65995, CHSIP. 


3.10.16.3 Crew Operation Loads 


Spacecraft hardware and equipment shall be operable with the lowest anticipated strength for 
tasks and flight configurations defined in Appendix E, "Minimum Crew Operation Loads." 
[R.CTS.195] 


Rationale: Hardware design should allow all crewmembers to perform any of the requested 
tasks efficiently and effectively, thus ensuring task and/or mission success. The data 
provided is for unsuited, suited-unpressurized, and suited-pressurized conditions. A human- 
centered design process is used when implementing operational strength limits, including 
analysis of expected crew operations, activities, and tasks that drive the design of human- 
machine interfaces. Guidance on the evaluation of design using crewmember strength data 
can be found in Section 4.5 of JSC 65995, CHSIP. 


3.10.16.4 Withstand Crew Loads 


Spacecraft components and equipment subjected to large forces by the crew shall withstand the 
forces as defined in Appendix E, Table E-1, "Crewmember Strength" ("Maximum Crew 
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Operation Loads" column) without sustaining damage for the pre-launch, ascent, orbit, and entry 
flight phases. [R.CTS.196] 


Rationale: Certain vehicle components and equipment are to be designed to withstand large 
forces exerted by a crewmember during nominal operation, without breaking or sustaining 
damage that would deem the hardware inoperable. Humans may exert high forces when 
operating controls in emergency situations, such as attempting to open a hatch for 
emergency egress. The resulting damage to equipment could make it impossible to respond 
safely to the emergency. To avoid overdesign, a task analysis is performed to identify which 
interfaces must tolerate maximum crew operational loads. This includes identifying critical 
hardware that may be inadvertently used as a mobility aid or restraint. Guidance on the 
evaluation of design using crewmember strength data can be found in Section 4.5 of JSC 
65995, CHSIP; information on task analysis process can be found in Section 4.1. This 
requirement is applicable to intentional forces imparted on hardware by a crewmember. 


3.10.17 Crew Support Equipment 
3.10.17.1 Trash Management 


The spacecraft shall provide a trash management system to contain, manage, and provide odor 
control for all trash, including biological waste and wet trash. [R.CTS.198] 


Rationale: The trash management system must contain all trash, with appropriate levels of 
containment and/or barriers, along with providing for odor control to avoid adverse effects 
on crew and crew performance. The trash management system is to be usable by crew and 
not allow inadvertent release of trash into the habitable volume during all mission phases. If 
not properly contained, trash contents could damage equipment, injure crewmembers, or 
transmit disease. 


The development of the trash management system includes an analysis of expected crew 
operations, activities, and tasks that will generate trash, along with a characterization of 
expected trash (e.g., constitution, toxicity level, odor, volume, etc.). The trash containment 
design considers crew usability, types of trash, how and where trash will be stowed, and 
duration of stowage until disposal, environmental conditions, such as cabin depressurization 
event, and method of disposal. For odors, bags can provide some odor control, but the best 
practice for odor control has been through air circulation design. For example, air may be 
circulated from the crew cabin, then past the waste system and into ECLSS returns and 
charcoal filters or slowly bled over-board. 


3.10.17.2 Sleep Accommodations 


The spacecraft shall provide accommodations and environment for crew sleep for all 
crewmembers. [R.CTS.199] 


Rationale: Proper sleep accommodations ensure that the crew is able to obtain adequate 
sleep/rest required for daily performance of tasks. Ideally, the system should provide a 
restrained position in accordance with the gravitational environment that allows for both full 
body extension, as well as for bringing both knees up to the chest. In order to develop an 
adequate sleep system, a human-centered design processes considers the following: 1) 
sufficient volume, 2) sleep surface area, including restraints for body positioning and 
blankets, 3) adjustable environmental conditions (e.g., lighting, noise), and 4) personal sleep 
items (e.g., clothing, bedding, and ear plugs). 
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3.10.17.3 RESERVED 
3.10.17.4 Body Waste Management 


The spacecraft shall provide a body waste management system and supplies that provide for 
crewmember hygiene and collection, containment, isolation, stowage, odor control, and labeling 
for waste containers for volumes listed in Table 3.10.17.4-1. [R.CTS.203] 


Rationale: Body waste management facilities must be clean, efficient, and provide privacy 
for crew comfort, safety, and psychological health. In order to develop an adequate system 
for body waste management, human-centered design must consider the following: 1) supplies 
necessary to support all post-event hygiene needs and a location for proper stowage of 
supplies (for example wipes, towels, vomitus bags) that may be rapidly and readily accessed 
while crewmembers are restrained, 2) facility accommodations (e.g., restraints, full body 
visual privacy, auditory and olfactory privacy, private body self-inspection, and odor control 
from the system and trash), 3) facility functionality (that is, allowing simultaneous urination 
and defecation without completely removing lower clothing, splash control, and readily 
accessible means for collection and containment), 4) means for cleaning, sanitizing, and 
maintaining body waste management equipment and facilities, and 5) readily accessible 
means to eliminate and contain body waste management supply remains or floating particles 
(for example wipe containment and trash collection system, including feminine hygiene 
items). Additional guidelines regarding facility accommodations for feces, diarrhea, urine, 
and vomitus are contained in JSC 65993, CHSIR requirements CH7008, CH7009, and 
CH7011, respectively. 


Table 3.10.17.4-1: Body Waste Management System Sizing Requirements 


Quantity is sass . . Max Rate per Event 


Fecal matter 1.7 events/crewmember/day 118 mL avg 
per defecation 


6 event/crewmember/day 333 mLavg_ | a) void rate of up to 50 mL/sec 
b) max output of | L during any 
given | hour period 


3.10.18 RESERVED 
3.10.19 Water 
3.10.19.1 Potable Water Physiochemical Limits 


The spacecraft shall provide potable water at or below the physiochemical limits defined in 
Appendix G, Table G-1 at all points of crew consumption or contact for drinking, food 
preparation, personal hygiene, and medical needs. [R.CTS.205] 
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Rationale: Safe water pollutant levels have been established specifically for human rated 
space vehicles by the JSC Toxicology Group in cooperation with a subcommittee of the 
National Research Council Committee on Toxicology or are based on Maximum 
Contaminant Levels (MCL) established by the U.S. Environmental Protection Agency (EPA). 
Points of crew consumption or contact refers to the locations from which potable water is 
dispensed for use in drinks, food rehydration, personal hygiene, medical needs, and any 
potential in-flight maintenance sites. 


3.10.19.2 Potable Water Microbial Limits 


The spacecraft shall provide potable water quality at or below the microbiological limits of Table 
3.10.19.2-1 for crew consumption, food preparation, personal hygiene, and medical needs. 
[R.CTS.206] 


Rationale: Microbially safe water is essential to prevent infection and mitigate risk to crew 
health and performance. Points of crew consumption or contact refers to the locations from 
which potable water is dispensed for use in drinks, food rehydration, personal hygiene, 
medical needs, and any potential in-flight maintenance Sites. 


Table 3.10.19.2-1: Potable Water Microbiological Limits 


Maximum Allowable 
CFU/ml 
Non-detectable per 100 ml Ea) 


Fungal Count Non-detectable per 100 ml Sa 


Parasitic Protozoa, e.g., Giardia and 
Cryptosporidium 


Note: CFU = Colony Forming Unit. 


3.10.19.3. Nominal Mission Water Provisions 
The spacecraft shall provide potable water as follows: 


a. A minimum of 2.6 L (88 fl oz) of potable water for each crewmember per mission day for 
consumption and hygiene use. 


b. A minimum of 1.0 L (total) of potable water for eye irrigation and contingency use for 
medical treatment. 


c. Ata temperature between 18 °C (64.4 °F) and 28 °C (82.4 °F) [R.CTS.207] 


Rationale: The amount of potable water required to maintain crewmember hydration status 
and allow crewmembers to perform duties nominally is 2.6 L (88 fl oz). Based on NASA's 
current food systems, intake breakdown consists of 2.6 L (88 fl oz) for drinking and hygiene 
water. The additional 1.0 L of water is reserved for eye irrigation and contingency use for 
medical treatment. The 1.0 L volume is for up to 4 crewmembers for all days of the mission 
to ISS. Eye irrigation is required for space flight based on experience and data from Shuttle, 
ISS, and Apollo programs. The water temperature range is required to prevent thermal 
injury to the tissues during irrigation. The quantity described in this requirement does not 
include potable water for other purposes such as sampling, pre-loading for reentry, and 
post-landing consumption, as represented in separate requirements. 
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3.10.19.4 Water Monitoring 


The spacecraft shall provide 3.5 L of potable water samples to support water quality monitoring 
from pre-launch check-out through post-landing recovery. [R.CTS.208] 


Rationale: Sufficient sampling water is needed to support ground-based analyses to ensure 
potable water quality. A quantity of 2.5 L (84.5 fl oz) of potable water is typical for pre- 
flight sampling and analysis to ensure the quality of the potable water loaded on the 
commercial vehicle for each launch. An additional 1.0 L (33.8 fl oz) is typically needed to 
support in-flight and post-flight sampling with ground-based analysis to confirm quality of 
the water consumed by the crew during each mission. A pre-flight potable water sampling 
and contamination assessment prevents in-flight water quality problems and thus minimizes 
the need for in-flight analysis of any potable water quality parameters. Ground-based 
quality analyses of in-flight and post-flight water samples provide a record of crew 
exposures and are used to determine follow-on ground processing steps. Ground crew or 
flight crew will collect the sample with NASA-provided sampling equipment carried in the 
environmental health kit, described in requirement 3.1.1.6, or provided to the ground crew. 
NASA or a NASA-approved laboratory will perform water quality analyses of the provided 
samples. If commercially available, pre-packaged water is provided as the source of potable 
water; water quantities for sampling may be reduced or waived upon NASA approval of the 
pre-packaged water quality and shelf-life. In order to facilitate this approval, a 
representative sampling strategy for this pre-packaged water would need to be developed. 


3.10.19.5 Water for Fluid Loading 


The spacecraft shall provide each crewmember with a minimum of 1.4 L (48.0 fl oz) of fluid for 
each of two deorbit attempts for reentry fluid loading countermeasure. [R.CTS.210] 


Rationale: The fluid quantity is based on Space Shuttle aeromedical flight rule for Earth 
reentry fluid loading and includes quantity to support 3.4.2.4 Support Deorbit Delay. The 
fluid may be potable water to drink with 12 salt tablets (NASA-provided per Table 3.1.1.6-1) 
or alternative approved solution (e.g., consommé). For each fluid load, up to 0.5 L (16.9 fl 
oz) of potable water may be used from unconsumed daily water allocation per crewmember. 
Without this additional water allocation, the crew may have inadequate water available to 
fluid load and may become hemodynamically compromised during and after deorbit. 
Inadequate fluid loading will almost certainly cause physiological difficulties in some, if not 
most, crewmembers. Reduced blood and plasma volume can exacerbate orthostatic 
intolerance. Therefore, the requirement for fluid loading prior to re-entry, landing, and 
post-landing is tightly coupled with the requirements to provide protection against 
orthostatic intolerance (compression garments). Protection against orthostatic intolerance 
includes three major elements: lower body compression garments, fluid loading, and suit 
dissipation of metabolic heat loads. 


3.10.19.6 Post-Landing Water 


The spacecraft shall provide immediate access to a minimum of 1.0 L (33.8 fl oz) of potable 
water per crewmember for each 8-hour period of the entire post-landing crew recovery period. 
[R.CTS.211] 


Rationale: Water is required during the entire post-landing phase, to ensure crewmembers 
are properly hydrated. This water needs to be available and accessible by the crew in their 
landing configuration (for example, seated and restrained) immediately upon landing. Less 


Commercial Crew Program 
International Space Station Program Page 107 of 295 


ISS Crew Transportation and CCT-REQ-1130 
Services Requirements Document Revision: E-1 


water may be needed for hydration following a launch abort, since crewmembers will not 
have undergone space flight fluid loss. Each period up to 8 hours requires IL of potable 
water per crewmember. It is acceptable to provide any additional water beyond the first 8 
hours in the crew survival kit, since that water would only be necessary in the event of an 
abort or contingency landing. 


3.10.20 Crew Workspace/Stowage 
3.10.20.1 RESERVED 
3.10.20.2 Habitable Space Sizing 


The spacecraft shall provide sufficient work and habitable space, stowage, and physical 
accommodation in the defined use environments and for the defined tasks. [R.CTS.213] 


Rationale: To maintain a habitable volume and high level of mission performance and safety, 
it is important that architectural layout of the vehicle is functionally designed to provide 
defined locations and volumes that support expected crew activities, including mission 
operations, habitability functions, maintenance, and translation (e.g., movement between 
areas). Every effort should be made to separate functional areas for activities that could 
degrade or operationally conflict with each other, particularly emergency response 
activities, or that produce environmental conditions that are detrimental to mission 
performance or safety. 


A human-centered design approach, as outlined in Section 3.1 of JSC 65995, will identify 
activities and/or tasks, especially those that are mission and safety critical, when designing 
functional layout. Mission and safety critical systems/hardware/components are to be 
identified using appropriate analysis methods. Guidance on design and evaluation of 
habitable volume can be found in Section 4.9 of JSC 65995, and information on evaluation of 
design using range of motion data can be found in Section 4.5, or in Appendix K of this 
document. Information on the crew task analysis process is in Section 4.1. 
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3.11. Ground Support Equipment (GSE) 
3.11.1 Design of GSE 


The GSE shall be designed to prevent invalidation of the flight hardware certification. 
[R.CTS.314] 


Rationale: The intent of this requirement is to ensure that the design of the GSE does not 
impact the ability to achieve and maintain certification of the flight hardware due to the 
unique hazards associated with the GSE interfacing with the flight hardware or while 
operating the GSE within the proximity of flight hardware. See CCT-STD-1140, Section 6.0 
for technical expectations pertinent to the engineering best practices for the design of GSE. 
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4.0 Test and Verification 


Verification requirements include the method(s) for verification (e.g., test and analysis), the purpose of 
the verification method(s), and the criteria for assessing the success of the verification method(s). 
Verification requirements take into account the specific design, relevant development and flight 
experience, and overall Commercial Provider plan for certification. Successfully implementing the 
methods defined in the verification requirements will enable the Commercial Provider to achieve 
certification by reducing the risk to a residual level acceptable by NASA. Final verification 
requirements must take into account the specific design, relevant development and flight experience, and 
overall Commercial Provider plan for certification. 


4.1 General 


Commercial Providers are responsible for verification planning and the performance of verification 
activities as specified in this document and in SSP 50808. The Commercial Providers will produce 
verification evidence for compliance with all applicable requirements. 


Verifications are performed to evaluate the system relative to an attribute established by the 
requirement. The evaluations must ensure capabilities are evaluated within all the constraints 
established by CCT-REQ-1130, SSP 50808, applicable laws and regulations. Thus, test, analyses, and 
demonstrations must consider the full required operating envelope, environments, other visiting vehicles 
attached to the ISS, and range of states of the system when formulating the evaluation conditions. 


The following definitions describe the methods that NASA would expect to use for verification of the 
requirements listed in Section 3.0, along with a brief description of each method. The test and 
verification methods described in the 4.3.X sections correspond to the 3.X requirement sections in the 
document. 


Inspection 

Engineering inspection, hereafter referred to as “inspection,” is a method of verification that determines 
conformance to requirements by the use of standard quality control methods to ensure compliance by 
review of drawings and data. This method is used wherever documents or data can be visually used to 
verify the physical characteristics of the product instead of the performance of the product. 


Analysis 
Analysis is a verification method utilizing techniques and tools such as math models, prior test data, 


simulations, analytical assessments, etc. The validation of the analysis with data acquired either by test 
or industry or government accepted standards, practices and methods is key to its credibility in critical 
decisions. Analysis may be used in lieu of, or in addition to, other methods to ensure compliance to 
specification requirements. The selected techniques may include, but not be limited to, task analysis, 
engineering analysis, statistics and qualitative analysis, computer and hardware simulations, and analog 
modeling. Analysis may be used when it can be determined that: 


a. Rigorous and accurate analysis is possible, and uncertainties and sensitivities are understood. 
b. Sufficient data exists, or can be made available, to validate the analysis. 


c. Verification by inspection is not adequate. 
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Examples of verification by analysis include thermal analysis and stress analysis to show that the use of 
the hardware does not exceed specification limits during the mission operation. Task analysis is used to 
verify that functional layout, reach, volume, workload, etc. support flight and ground crew activities. 


Demonstration 


Demonstration consists of a qualitative determination of the properties of a test article. This qualitative 
determination is made through observation, with or without special test equipment or instrumentation, 
which verifies characteristics, such as human engineering features, services, access features, and 
transportability. Human-in-the-loop demonstration is performed for complex interfaces or operations 
that are difficult to verify through modeling analysis, such as physical accommodation for crew ingress 
and egress. Demonstration requirements are normally implemented within a test plan, operations plan, 
or test procedure. 


Test 


Test is a method in which technical means, such as the use of special equipment, instrumentation, 
simulation techniques, and the application of established principles and procedures are used for the 
evaluation of components, subsystems, and systems to determine compliance with requirements. Test 
will be selected as the primary method when analytical techniques do not produce adequate results; 
failure modes exist which could compromise personnel safety, adversely affect flight systems or payload 
operation, or result in a loss of mission objectives. The analysis of data derived from tests is an integral 
part of the test program and should not be confused with analysis, as defined above. Tests will be used 
to determine quantitative compliance to requirements and produce quantitative results. 


4.1.1 Requirements Verification Approach 
The Commercial Provider’s verification process will consist of, but not be limited to: 


Data for the reliability analysis collected and recorded during qualification. 


b. Engineering (development) evaluation and tests may be required for analyzing design 
approaches to ensure that requirements encompassing material selection, tolerances, and 
operational characteristics are satisfied. If development test data is intended to be used to 
qualify hardware, its intent will be previously declared. 


c. A qualification program encompassing the entire range of activity to verify that the design 
conforms to requirements when subjected to environmental life-cycle conditions, including 
those required for environmental workmanship screening during the acceptance phase. 
Flight fidelity qualification test articles will be used for the qualification program. 


d. Environmental models will be used to represent environments that cannot be achieved under 
the conditions of ground testing. Simulators, used for verifying requirements, will be 
validated such that the item undergoing qualification cannot distinguish between the 
simulator and actual operation hardware/software. 


e. Integration testing and checkout will be conducted during CTS hardware buildup. Activities, 
such as continuity checking and interface mating, will be performed. Activities, such as 
major component operation in the installed environment, support equipment compatibility, 
and documentation verification, will be proven during qualification. 
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f. Qualification of CTS ground facilities will be performed in support of analyses, ground 
testing, and other verification activities. Qualification of facilities can be performed by 
comparison to real-world results or to another qualified facility. 


g. Formal verification of performance characteristics for the full range of performance 
requirements will be accomplished during qualification. 


4.1.2 Element Test Phase 


The basic objectives of ground tests will include, but not be limited to: 


a. Structural verification, including verification of stress and loads models and structural 
response (static, dynamic, acoustic, impact, and vibration tests). 


b. Validation of hardware layout modeling, installation, and assembly. 
c. Testing of life support systems. 


d. Thermal conditions of systems and structures, including those in a Flight Equivalent Unit 
(FEU) environment. 


e. Testing commercial crew communications systems, including RF blockage and multipath 
characterization. 


f. Firing tests (engine burns) and gas dynamics tasks. 


g. Testing and verification of the operability of the emergency rescue system (for COTS crew 
transport). 


h. Integrated electrical tests, including avionics tests. 
i. Integrated software tests, including testing in NASA Software Verification Facility. 


j. Integrated GN&C tests. 


4.2 Qualification and Acceptance Test Requirements 


The CTS qualification requirements are specified in section 3.9.13.1 of this document. Acceptance 
requirements of hardware for tests, as well as final flight units, are to be developed as part of the 
provider-developed CTS Certification Plan. 
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4.3. ISS Crew Transportation and Service Requirements 
4.3.1 ISS Destination Services 

4.3.1.1 Top Level System 

4.3.1.1.1 Launch Rate 


The ability of the CTS to perform two ISS missions in a year shall be verified by analysis. A 
statistical analysis shall determine the time required, in consideration of resources shared with 
other customers, to produce, transport, assemble, and test the flight systems and integrate them 
into mission configuration and prepare them for launch. The analysis shall also determine the 
time required to perform the requisite pre-mission planning, crew training, completion of the 
resolution plans of previous in-flight anomalies, and other required services. The analysis shall 
be in support of two, back-to-back, 180-day, missions beginning with mission requirements 
definition and ending with the nominal launch day. The verification shall be considered 
successful when the analysis shows the system and personnel preparation for launch can support 
two launches per year with a 95% probability and a 90% confidence. [V.CTS.001] 


4.3.1.1.2 Simultaneous Operation of Spacecraft 


The capability of the CTS to operate two spacecraft simultaneously shall be verified by 
inspection and analysis. The inspection shall review the procedures and staffing plans. An 
analysis of the capabilities of the CVCC(s), communications network, spacecraft and other 
ground-based systems shall be performed to determine if all mission requirements, for one 
docked spacecraft and one spacecraft operating in the free-flight mode or for both spacecraft 
docked, can be met. The verification shall be considered successful when inspection and 
analysis shows the flight and ground systems have the capability to simultaneously operate both 
spacecraft. [V.CTS.002] 


4.3.1.1.3 ISS Operations Impacts 


The requirement of the CTS to operate without impacting ISS operations due to real-time 
commanding, active monitoring, or maintenance during quiescent docked operations shall be 
verified by analysis. The analysis shall evaluate the provider’s staffing plans, operations plans, 
operating procedures, and the CTS design. The verification shall be considered successful when 
the analysis shows the CTS can operate without impacting ISS operations due to real-time 
commanding, active monitoring, or maintenance during quiescent docked operations beyond the 
allowances specified in 3.8.3.1. [V.CTS.003] 


4.3.1.1.4 EVA Operations 


The ability of the CTS to perform all required mission functions and objectives without the use 
of EVA for nominal operations, contingency operations, or maintenance activity shall be verified 
by inspection. The inspection shall include a review of safety analysis and all planned and 
contingency operations. The verification shall be considered successful when completion of the 
inspection shows that there is no EVA required for nominal operations, contingency operations, 
or maintenance activity. [V.CTS.004] 


4.3.1.1.5 Provide Supplies 


The CTS's provision of equipment, supplies and consumables shall be verified by analysis and 
inspection. The analysis shall be performed to show that the supplies meet the required functions 
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and have sufficient quantity to meet the mission duration, including contingencies. The 
verification shall be considered successful when an inspection of drawings, hardware, and 
manifested equipment show that the spacecraft will be capable of carrying the necessary 
commodities for the crew. [V.CTS.005] 


4.3.1.1.6 Transport NASA-Provided Supplies 


The spacecraft's accommodation and utilization of NASA-provided supplies shall be verified by 
inspection and analysis. An inspection of drawings and equipment lists shall be performed to 
show the required stowage volume is available, supplies are accessible in the flight configuration 
and the required mass is allocated. An analysis shall be performed to determine the accessibility 
times required to meet mission operations and contingencies. The verification shall be 
considered successful when inspection of drawings shows the stowage masses and volumes are 
accommodated and the analysis shows the locations are accessible in the flight configuration in 
the time required for the operation the supplies support. [V.CTS.336] 


4.3.1.1.7 Supplies for Non-NASA Crew 


The CTS's provision of habitable consumables for non-NASA crew shall be verified by analysis 
and inspection. An analysis shall be performed to determine the habitable consumables required 
for the non-NASA crew during docked operations. A functional and performance analysis of 
consumable delivery shall be performed to show spacecraft resources are available to deliver 
consumables and delivery is within SSP 50808 constraints during docked operations. The 
verification shall be considered successful when an inspection done of drawings, hardware, and 
manifested equipment show that the spacecraft will be capable of carrying the necessary 
commodities for the non-NASA crew and the analysis shows spacecraft resources are available 
to transfer the required commodities. [V.CTS.006] 


4.3.1.1.8 NASA Crew 


The CTS's accommodation of 1, 2, 3, and 4 NASA crew during a single mission shall be verified 
by analysis and inspection. An analysis shall be performed to show the CTS can support the 
required crew size. An inspection of spacecraft drawings shall identify design accommodations 
for the maximum crew, cargo, and equipment. The verification shall be considered successful 
when the analysis and inspection show the CTS is capable of accommodating 1, 2, 3, and 4 
NASA crew. [V.CTS.389] 


4.3.1.2 Crew Transportation 
4.3.1.2.1 Transport Crew 


The ability of the CTS to transport crew to the ISS shall be verified through test and analysis. 
The tests shall verify the required performance of the flight systems and may determine the 
statistical dispersions on their performance. Analysis shall include verified 3DOF and 6DOF 
simulations, including appropriate modeling of all systems affecting vehicle dynamics, along 
with their production variability and uncertainties for all appropriate flight phases. The 
trajectory simulations shall model the spacecraft's entire trajectory from launch through docking 
at the ISS for all required crew and cargo configurations. The analysis shall assume that the ISS 
does not perform translational maneuvers at any time to support rendezvous and, for this 
verification, is within the altitude band of 370km-460km. For the purposes of this verification, 
"docking" is defined as the planned first contact between the docking mechanisms. The 
simulation shall be considered successful for each case if the spacecraft docks to the ISS 24 
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hours after launch, when both the spacecraft and launch vehicle operate within verified 
capabilities, while observing defined limits for human capability, and while maintaining the 
expected factors of safety for vehicle thermal limits and structural load limits. This verification 
is intended to address nominal system operations and should not include flight or ground system 
failure scenarios or docking contingencies. The verification shall be considered successful when 
the Monte Carlo simulation(s) of the required transport scenarios, with natural environment and 
flight performance dispersions, achieves a 99.73% probability of success with at least 90% 
confidence throughout the transport mission profile. [V.CTS.010] 


4.3.1.2.2. Return Crew 


The ability of the CTS to return crew from the ISS shall be verified through test and analysis. 
The tests shall verify the required performance of the flight systems and may determine the 
statistical dispersions on their performance. Analysis shall include verified 3DOF and 6DOF 
simulations, including appropriate modeling of all systems affecting vehicle dynamics, along 
with their production variability and uncertainties for all appropriate flight phases. The 
trajectory simulations shall model the spacecraft's entire trajectory from un-docking within the 
ISS altitude band, as specified in SSP 50808 3.3.3.2.18, ISS Attitude and Orbit Constraints, 
through landing at each supported site for all required crew and cargo configurations. The 
simulation shall be considered successful for each case if the spacecraft successfully lands within 
the boundaries of a supported landing site, when the spacecraft operates within verified 
capabilities, while observing defined limits for human capability, and while maintaining the 
expected factors of safety for vehicle thermal limits and structural load limits. This verification 
is intended to address nominal system operations and should not include flight or ground system 
failure scenarios or deorbit contingencies. The verification shall be considered successful when 
the Monte Carlo simulation(s) of the required return scenarios, with natural environment and 
flight performance dispersions, achieves a 99.73% probability of success with at least 90% 
confidence throughout the return mission profile. [V.CTS.011] 


4.3.1.2.3 Docked Duration 


The requirement of the spacecraft to remain docked to the ISS for 210 days shall be verified by 
analysis. The analysis shall be performed for a full duration stay at each designated docking port 
and include the CTS spacecraft consumables quantities and margins maintained while docked, a 
crew timeline model for planned preventive maintenance based on component lifetimes and 
reliability, and data supporting component lifetime and reliability ratings. The verification shall 
be considered successful when the analysis shows the spacecraft has the consumables and 
functionality to support a crew return after a docked duration of 210 days. [V.CTS.012] 


4.3.1.2.4 Rotation Intervals 


The ability of the CTS to exchange up to 4 ISS NASA crew every 150 to 210 days shall be 
verified by analysis. A statistical analysis shall bound the time required to produce, transport, 
assemble, and test the flight systems and integrate them into mission configuration and prepare 
them for launch. The analysis will also bound the time required to perform the requisite pre- 
mission planning, crew training, completion of the resolutions plans of previous in-flight 
anomalies, and other required services. The analyses shall be in support of exchanging up to 4 
NASA ISS crewmembers every 150 to 210 days beginning with mission requirements definition 
and ending with the nominal launch day. The verification shall be considered successful when 
the analysis shows the system and personnel preparation for launch can support exchanging up to 
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4 NASA ISS crewmembers every 150 to 210 days with a 95% probability and a 90% confidence. 
[V.CTS.013] 


4.3.1.2.5 Launch Sites 


The ability of the CTS to launch NASA crew from a U.S. (or U. S. State Department approved) 
launch site(s) shall be verified by inspection. The verification shall be considered successful 
when an inspection of the launch site shows it is a U.S. (or U. S. State Department approved) 
launch site(s). [V.CTS.014] 


4.3.1.2.6 Landing Sites 


The ability of the CTS to return NASA ISS crew to a designated primary landing site shall be 
verified by analysis and inspection. A functional analysis shall be performed to determine the 
ground system capabilities required at the landing site. The verification shall be considered 
successful when analysis of ground system capabilities and the inspection of drawings, 
equipment lists, and landing site features determine that ground system capabilities are available 
throughout the landing site. [V.CTS.015] 


4.3.1.3 Cargo Transportation 
4.3.1.3.1 Accommodate Soft Stowage Cargo 


The spacecraft's accommodation of soft stowage cargo shall be verified by inspection. An 
inspection of cargo bays/stowage locations drawings shall be performed to show the volume 
allocated, with applicable dimensioning. An inspection of the spacecraft mass budgets shall be 
performed to show mass is allocated for cargo delivery and return. An inspection shall review 
verification closure of SSP 50833 Section 3.1.2, except for Triple CTB's in section 3.1.2.1 and 
all M-Bags in section 3.1.2.2. The verification shall be considered successful when the 
inspection confirms that the allocated volume and mass calculated is equal to or greater than the 
requirement and the cargo locations meet the applicable sections of SSP 50833. [V.CTS.016] 


4.3.1.3.2 RESERVED 
4.3.1.3.3 Cargo in lieu of Crew 


The spacecraft's ability to accommodate an additional 100 kg of cargo in lieu of aNASA 
crewmember shall be verified by inspection. An inspection of spacecraft drawings shall be 
performed to show the volume allocated, with applicable dimensioning. An inspection of 
spacecraft mass budgets shall be performed to show mass is allocated for cargo delivery and 
return. An inspection shall review verification closure of SSP 50833 Section 3.1.2, except for 
Triple CTB's in section 3.1.2.1 and all M-Bags in section 3.1.2.2. The verification shall be 
considered successful when the inspection confirms that the volume and mass allocations are 
available to transport 100 kg of soft stowage cargo in lieu of a NASA crewmember and the cargo 
locations meet the applicable sections of SSP 50833. [V.CTS.020] 


4.3.1.3.4 Accommodate Hard Mounted Cargo 


The spacecraft's ability to accommodate hard mounted cargo shall be verified by inspection, test 
and analysis. An inspection of spacecraft drawings shall be performed to show the volume 
allocated, with the applicable dimensioning. An inspection of spacecraft mass budgets shall be 
performed to show mass is allocated for cargo delivery and return. An inspection shall review 
verification closure of SSP 50833 Sections 3.1.1 and 3.1.2, except for Triple CTB's in section 
3.1.2.1 and all M-Bags in section 3.1.2.2. The analysis shall consist of thermal and power 
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assessments showing sufficient budgets for all flight phases. The test shall evaluate the ability to 
load two single powered middeck lockers or one double powered middeck locker using flight 
representative cargo and perform a mechanical, electrical and data interface test. The 
verification shall be considered successful when the inspection, test and analysis show the 
spacecraft is capable of accommodating each configuration of: two powered single middeck 
lockers, one powered double middeck locker, and equivalent soft stowage while meeting the 
applicable sections of SSP 50833. [V.CTS.021] 


4.3.1.3.5 Hard Mounted Cargo in lieu of Soft Stowage Cargo 


The spacecraft's ability to accommodate additional hard mounted cargo in lieu of the soft 
stowage cargo required by 3.1.3.1 shall be verified by inspection, test and analysis. An 
inspection of spacecraft drawings shall be performed to show the volume allocated, with 
applicable dimensioning. An inspection of spacecraft mass budgets shall be performed to show 
mass is allocated for cargo delivery and return. An inspection shall review verification closure of 
SSP 50833 Section 3.1.1. The analysis shall consist of a thermal and power assessments 
showing sufficient budgets for all flight phases, with at least 220W of power and 220W heat 
rejection for the sum of all powered cargo. The test shall evaluate the ability to load two single 
powered middeck lockers or one double powered middeck locker using flight representative 
cargo and perform a mechanical, electrical and data interface test. The verification shall be 
considered successful when the inspection, test and analysis show the spacecraft is capable of 
accommodating two additional powered single middeck lockers or one additional powered 
double middeck locker in lieu of the passive cargo specified in 3.1.3.1 and the cargo locations 
meet SSP 50833 Section 3.1.1. [V.CTS.383] 


4.3.1.3.6 Time-Critical Cargo Pre-Launch Handling 


The ability of the CTS to maintain cargo services per SSP 50833 and install soft stowage and 
hard mounted time-critical cargo within 24 hours of a launch shall be verified by demonstration 
and inspection. A demonstration shall be performed in the L-24 flight representative 
configuration and will evaluate the time to install and checkout time critical cargo within the 
allocated timeline. An inspection of the L-24 pre-launch timeline shall confirm an allocation for 
time critical cargo stowage activities. An inspection shall review verification closure of SSP 
50833 Section 3.1.1. In addition, an inspection of spacecraft drawings shall verify access to all 
areas of the spacecraft available for storage of time critical cargo and the availability of these 
areas within the L-24 pre-launch timeline. The verification shall be considered successful when 
the demonstration and inspection show that the time to install and checkout time-critical cargo is 
equal to or less than the allotted time allowed by the pre-launch payload installation timeline in 
the L-24 window of opportunity and cargo services are maintained per SSP 50833, Section 3.1.1. 
[V.CTS.018] 


4.3.1.3.7 Time-Critical Cargo Removal 


The ability of the CTS to remove cargo from the pressurized volume no later than 1 hour after 
crew egress shall be verified by demonstration and inspection. The post-landing demonstration 
shall be performed with vehicle and cargo hardware in the landed-flight configuration and 
environment, post crew egress. The post-docking demonstration shall be performed with vehicle 
and cargo hardware in the flight configuration in a 1-g environment to ensure range of motion, 
clearance and fit. The verification shall be considered successful when the inspection shows 
processing timelines and environments for post-landing and post-docking scenarios are 
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commensurate with the demonstration results and provide for cargo removal within | hour after 
crew egress. [V.CTS.019] 


4.3.1.3.8 Docked Cargo Services 


The ability of the spacecraft to maintain cargo services shall be verified by inspection and 
analysis. For the purposes of this verification, it shall be assumed that the ISS will provide all 
necessary power and intermodule ventilation (IMV) to support spacecraft and cargo operations. 
The analysis shall evaluate the required ISS resources necessary to support spacecraft and cargo 
operations and evaluate the environmental conditions of the cargo. The analysis shall also 
ensure that the reliability of spacecraft systems necessary to support cargo operations is 
provided. An inspection shall review verification closure of SSP 50833, Section 3.1.1 for the 
available cargo services and environment. The verification shall be considered successful when 
the analysis and inspection show the spacecraft can maintain the spacecraft system reliability and 
cargo services per SSP 50833, Section 3.1.1. [V.CTS.394] 


4.3.1.4 Launch and Landing Probability/A vailability 
4.3.1.4.1 Launch Availability 


The CTS’s launch probability, excluding external constraints and abort zone weather, of not less 
than 80% shall be verified by analysis. An analysis shall determine the probability of launch for 
launch opportunities when the ISS is within planar and phasing capabilities and within CTS 
weather constraints derived from the launch vehicle and spacecraft operating limits and 
integrated launch loads analysis throughout the dispersed trajectory. Historical monthly weather 
data shall be used in these assessments. A system availability analysis shall determine the 
probability of launch including reliability of ground systems, CVCC, spacecraft and launch 
vehicle systems throughout launch operations in the induced and natural environments from 
tanking until launch window close. The verification shall be considered successful when the 
analysis determines the combined probability of launch within CTS weather constraint and 
system availability is not less than 80% with a 90% confidence. [V.CTS.022] 


4.3.1.4.2 Launch Recycle Time 


The CTS's ability to provide launch opportunities for two consecutive days, beginning with the 
initial launch attempt, shall be verified by analysis. The analysis shall assess pad, launch 
vehicle, spacecraft, and CVCC launch re-cycle timelines including a task by task review of 
activity durations commodity availability and capacity; operations and logistics plans; and the 
time and resources required to perform launch tasks on consecutive calendar days. The 
verification shall be considered successful when the analysis results show that the CTS 
architecture can provide launch opportunities for two consecutive calendar days. [V.CTS.023] 


4.3.1.4.3 Launch Lighting 


The ability of the CTS to launch independent of all ambient lighting conditions shall be verified 
by analysis. The analysis shall include a review of CTS systems required to enable launch under 
any lighting conditions and can show that the flight systems, facility systems, and GSE will 
operate independent of all ambient lighting conditions for launch. Systems to be considered are 
tracking (optics and radar), recovery/rescue aids, imagery (ground and flight based), GSE, and 
facilities. The verification shall be considered successful when the analyses show that the flight 
and ground systems are capable to support launch of the integrated space vehicle independent of 
all ambient lighting conditions. [V.CTS.024] 
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4.3.1.4.4 Landing Lighting 


The ability of the CTS to land independent of all ambient lighting conditions shall be verified by 
analysis. The analysis shall include a review of CTS systems, required to enable landing during 
any lighting conditions and can show that the flight systems, facility systems, and GSE will 
operate independent of all ambient lighting conditions for landing. Systems to be considered 
include tracking (optics and radar), navigational landing aids, recovery/rescue aids, imagery 
(ground and flight based), GSE, and facilities. The verification shall be considered successful 
when the analyses show that the flight and ground systems are capable to support landing of the 
CTS independent of all ambient lighting conditions. [V.CTS.025] 


4.3.1.5 Onorbit 
4.3.1.5.1 RPOD Lighting 


The spacecraft's ability to perform rendezvous, proximity operations, docking, and undocking 
independent of lighting and ground site overflight constraints shall be verified by inspection and 
analysis. An inspection shall be performed on the CTS constraints (such as GNC, 
communications, sensors, thermal control) to determine the effects of ambient lighting and 
ground site location on spacecraft operations for rendezvous, proximity operations, docking and 
undocking. The analysis shall show that the dispersed nominal and planned contingency 
trajectories and timeline are uninhibited by lighting and ground site overflight constraints. Only 
a possible exception for minor approach adjustments during brief periods of degraded 
navigation/crew visibility will be allowed. The analysis shall encompass all possible lighting 
conditions including the complete range of solar and lunar beta angles. The verification shall be 
considered successful when, for all US docking ports, the inspection and analysis shows that 
ground overflight and ambient lighting constraints used in the trajectory design, including 
selection of planned docking and undocking times, allow docking and undocking to occur within 
95% of the planned orbit. 


See CCT-STD-1140, "Flight Mechanics and GN&C Technical Assessment" section for technical 
verification expectations pertinent to flight mechanics. [V.CTS.026] 


4.3.1.5.2 Relocate to Different Docking Port 


The spacecraft's ability to perform one relocation between docking ports after the initial docking 
shall be verified by analysis. Statistical analysis shall determine the vehicle state (position and 
attitude) dispersions and system performance required to accomplish the relocation. For the 
purposes of this verification, "docking" is defined as the planned first contact between the 
docking mechanisms. The verification shall be considered successful when the analysis shows at 
least 99.73% with 90% confidence of the cases dock within the docking contact conditions. 
[V.CTS.027] 


4.3.1.5.3 ISS Fly-around 


The spacecraft's ability to perform one complete fly-around after undocking at a range of less 
than 250 meters, as measured from spacecraft center of mass to ISS center of mass, shall be 
verified by analysis. A statistical analysis shall determine the vehicle state (position and attitude) 
dispersions and system performance required to accomplish the fly-around. The verification 
shall be considered successful when the analysis shows at least 95% with 90% confidence of the 
cases result in a 360 degree planar transit around the ISS. [V.CTS.028] 
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4.3.1.5.4 Support Photography during Fly-Around 


The spacecraft's provision for crew photography shall be verified by test, analysis and inspection. 
The test shall characterize the optical properties of the crew photography window(s). Visual 
uniformity inspections shall be done on the finished windows; otherwise, any other inspections 
may be done on witness samples. The analysis shall evaluate the spacecraft fly-around trajectory 
and the photography window orientation. The verification shall be considered successful when 
the analysis shows that the crew photographer can take pictures without impeding the piloting 
tasks and the test shows the windows’ optical properties meet or exceed category D of JSC 
66320 and the visual uniformity inspections show that there are no readily identifiable non- 
uniformities in any of the individual panes and in the finished window stack. [V.CTS.384] 


4.3.2 Safety and Mission Assurance 
4.3.2.1 Crew Safety 
4.3.2.1.1_ Loss of Crew Risk 


The CTS shall verify the Loss of Crew (LOC) requirement for all nominal mission phases and 
contingency operations: 


a. Mission: The mean LOC risk for any ISS mission shall be verified through a Probabilistic 
Safety Analysis (PSA). The PSA methodology shall be defined utilizing the methodology 
described in CCT-PLN-1120 as a guide. The mission LOC shall include LOC faults initiated 
by the CTS from the beginning of crew ingress, prior to launch, through crew egress during 
recovery. The LOC analysis shall exclude operational controls from the ISS performed while 
approaching, departing and docked to ISS, such as TPS inspections. The LOC analysis shall 
include Contingency Spacecraft Crew Support (See Appendix B) for CTS initiated faults 
which preclude the capability for entry. Since crew rescue mission plans have not been 
finalized, crew rescue mission effectiveness shall be defined as a uniform distribution 
between 97% and 99% multiplied by the probability of a successful CTS reentry for the 
purpose of LOC calculations. The verification shall be considered successful when the 
analysis shows the calculated mean value of LOC for the 210 day mission is no greater than 
1 in 200. 


b. Ascent/Entry: The mean LOC risk for any ISS mission combined ascent and entry phase 
shall be verified through a PSA. The PSA methodology shall be defined utilizing the 
methodology described in CCT-PLN-1120 as a guide. The mean LOC risk shall be 
calculated for ascent and entry separately, but for the purposes of requirement verification, 
ascent and entry shall be combined. Ascent LOC analysis shall include all ascent LOC faults 
initiated from the beginning of crew ingress, prior to launch, through orbital insertion and 
entry LOC includes all entry LOC faults initiated from deorbit burn ignition through crew 
egress during recovery. The verification shall be considered successful when the analysis 
shows the calculated mean value of LOC for the combined ascent and entry phase is no 
greater than | in 500. [V.CTS.030] 


4.3.2.1.2 Loss of Mission Risk 


The CTS Loss of Mission (LOM) for an ISS mission shall be verified by a PSA. The PSA 
methodology shall be defined utilizing the methodology described in CCT-PLN-1120 as a guide. 
LOM is defined in Appendix B. LOM analysis shall include faults initiated by the CTS which 
lead to an ascent abort or termination of the mission earlier than the pre-launch planned EOM 
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timeframe, contingency spacecraft crew support (see Appendix B), inability to dock with the 
ISS, and LOC. Loss of low priority mission objectives, such as cargo, inability to perform fly- 
around, ISS port relocation, or minor mission delays are not considered a LOM. Verification 
shall be successful when the analysis shows the calculated mean value of LOM for the entire 210 
day mission is no greater than | in 55. [V.CTS.031] 


4.3.2.1.3 Flight Element Stability 


The stability and control requirement shall be verified through analysis. Analysis shall include 
verified 6DOF simulations, including appropriate modeling of all systems affecting vehicle 
dynamics, along with their uncertainties, as well as stability analysis for all appropriate flight 
phases. The verification shall be considered successful when the analysis shows a 99.73% 
probability, with 90% confidence, that the vehicle will be controllable and that there is stability 
with established margin. See CCT-STD-1140 section 5.4.2, "Flight Mechanics and GN&C 
Technical Assessment" for technical verification expectations pertinent to flight mechanics. 
[V.CTS.317] 


4.3.2.2 Safety and Hazard Control 
4.3.2.2.1_ Monitor Controls and Inhibits 


The CTS monitoring of the status of controls and inhibits shall be verified by analysis. A hazard 
analysis shall identify controls and inhibits whose inadvertent activation or failure to activate 
leads to a catastrophic event. A functional and performance analysis shall define the functions, 
limits, and scales of each monitoring capability. The verification shall be considered successful 
when the analysis of each monitoring capability indicates the operational status of the control or 
inhibit can be ascertained by the system or crew. [V.CTS.033] 


4.3.2.2.2 Control Critical Hazards 


Control of critical hazards shall be verified by hazard analysis. The provider methodology, 
process, and plans for conducting the hazard analysis shall be consistent with CCT-PLN-1120. 
The verification shall be considered successful when the hazard analysis shows that all identified 
critical hazards are controlled and the hazard controls are verified. [V.CTS.341] 


4.3.2.3 Failure Tolerance 
4.3.2.3.1 Failure Tolerance to Catastrophic Events 


Failure tolerance for catastrophic hazards shall be verified by analysis. An integrated hazard 
analysis shall be performed to identify all potential hazard causes and controls and show 
compliance with the required level of failure tolerance. The provider methodology, process, and 
plans for conducting the hazard analysis shall be consistent with CCT-PLN-1120. The 
verification shall be considered successful when the analysis shows that all identified 
catastrophic hazards that are mitigated by failure tolerance are controlled and verified. 
[V.CTS.034] 


4.3.2.3.2 Failure Tolerance without Aborts 


The CTS's ability to not rely on pad or ascent aborts, or emergency systems to meet failure 
tolerance requirements shall be verified by inspection. The verification shall be considered 
successful when review of the failure tolerance verification analysis (Paragraph 4.3.2.3.1) 
ensures that failure tolerance is not met through reliance on the proper operation of pad or ascent 
aborts, or an emergency system. [V.CTS.035] 
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4.3.2.3.3 Separation of Redundant Systems 


The CTS separation of redundant systems should be verified by analysis. The hazard analysis 
should examine redundant systems for potential common cause events. The verification will be 
considered successful when the analysis ensures the physical separation or protection of the 
systems is present. [V.CTS.339] 


4.3.2.3.4 Isolate and Recover from Faults 


The CTS's ability to perform fault isolation and recovery of functions, the absence of which 
would result in a catastrophic event, shall be verified by analysis and demonstration. Safety 
analysis shall identify the faults for which the system shall isolate and recover. The verification 
shall be considered successful when the critical faults identified by the safety analysis have been 
confirmed by demonstration to be isolated and the associated redundant function is activated in 
time to prevent the catastrophic event. [V.CTS.038] 


4.3.2.3.5 Failure Tolerance without Corrective Maintenance 


The CTS's ability to not rely on maintenance to meet failure tolerance requirements shall be 
verified by inspection. The verification shall be considered successful when review of the failure 
tolerance verification analysis (Paragraph 4.3.2.3.1) ensures that failure tolerance is not met 
through corrective maintenance. [V.CTS.125] 


4.3.2.4 Health and Status 
4.3.2.4.1 Detect and Annunciate Faults 


The CTS's detection and annunciation of critical faults shall be verified by analysis and test. 
Safety analysis shall identify all critical faults the system shall detect and annunciate. The test 
shall be performed by simulating the critical faults using flight software and flight representative 
hardware. The verification shall be considered successful when the critical faults identified by 
the safety analysis have been confirmed by test to be detected and annunciated. [V.CTS.037] 


4.3.2.4.2 Record and Display Health and Status 


The CTS's recording, transmission, and display of health, status, and engineering data shall be 
verified by analysis and test. The analysis shall identify the required health, status, and 
engineering data sets needed and the timeliness required for the intended use in nominal 
operations, anomaly resolution, catastrophic event reconstruction, and commit to flight decision 
making. The verification shall be considered successful when the test confirms the required sets 
of generated health, status, and engineering data are recorded, displayed to the crew, and 
received at the CVCC in a time consistent for the purposes they are intended, in support of 
nominal operations, flight anomaly resolution, catastrophic event reconstruction, and commit to 
flight decision making. [V.CTS.040] 


4.3.2.4.3 Flight Imagery 


The CTS's capture, recording, transmission, and time synchronization of imagery data shall be 
verified by analysis and demonstration. The analysis shall identify the required field of view, 
resolution, frequency of images, etc. needed for performance assessment, anomaly resolution, 
and mishap event reconstruction. The verification shall be considered successful when the 
demonstration confirms the required systems are functional and provide the imagery needed for 
performance assessment, flight anomaly resolution, and mishap event reconstruction. 
[V.CTS.072] 
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4.3.2.4.4 Monitor Environments 


The ability of the CTS for capturing data of the direct and indirect effects of natural and induced 
environments shall be verified by analysis and inspection. The analysis shall determine the 
natural and induced environments that could exceed certification limits prior to launch. The 
verification shall be considered successful when the inspection shows that systems are employed 
to capture data associated with environmental and operational events that could result in 
exceedances to the integrated space vehicle design limits during production, handling, 
transportation, assembly/integration/testing, pre-launch processing, launch operations phases, 
and post-landing (if flight hardware is planned to be reused). [V.CTS.074] 


4.3.2.4.5 Natural Environments 


The establishment and utilization of identified natural environments to the CTS shall be verified 
by inspection. Natural environment related risks, mitigation methods, and related design margins 
shall be identified and controlled in accordance with the criteria in the "Natural Environments" 
section of CCT-STD-1140. The inspection shall review verification closure of allocations of the 
identified natural environments to design elements. The verification shall be considered 
successful when the inspection shows that the identified natural environments have been utilized 
in the evaluation of CTS design elements. [V.CTS.382] 


4.3.2.5 Emergency Equipment 
4.3.2.5.1 Access Emergency Equipment 


The access of CTS emergency equipment within a time commensurate with the applicable 
emergency shall be verified by analysis and demonstration. The analysis shall identify and 
determine time to respond to emergency situations. The demonstration shall show that a 
crewmember can access emergency equipment and position it for use in a flight representative 
vehicle in flight configuration. The verification shall be considered successful when the analysis 
and demonstration confirm that emergency equipment can be accessed for response to 
emergency situations without the use of tools and within the time required to respond to the 
hazard. [V.CTS.041] 


4.3.2.5.2 Breathing Mask 


The spacecraft's ability to supply a contingency breathing apparatus whenever the cabin 
atmosphere may be contaminated and whenever an unplanned reduction in cabin pressure occurs 
shall be verified by inspection and analysis. An inspection shall be performed that shows an 
adequate number of contingency breathing apparatuses are stored on the spacecraft to support all 
crewmembers onboard the spacecraft at all times and identifies the stowage location. The 
inspection must also show that the apparatus protects each crewmember's eyes and respiratory 
system during an emergency event. An analysis shall be performed to show that the contingency 
breathing apparatus can fit the varying size of any crewmember onboard the spacecraft. Another 
analysis shall be performed to show that the contingency breathing apparatus provides a safe 
individual breathing supply to all crewmembers simultaneously for the duration needed 
whenever the cabin atmosphere may be contaminated and whenever an unplanned reduction in 
cabin pressure occurs. The verification shall be considered successful when inspection and 
analysis show that the contingency breathing apparatus provides each crewmember a safe 
individual breathing mask to provide protection and breathable atmosphere until CO, HCN, and 
HCI levels have been re-established per table 3.10.11.1.3-1 in case of contamination event and 
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until crew are in a fully functioning pressure suit in case of an unplanned reduction in cabin 
pressure. [V.CTS.042] 


4.3.2.5.3. Voice Communication in Breathing Apparatus 


The CTS's capability for crew to communicate with other crewmembers and with the CVCC 
while wearing contingency breathing apparatus shall be verified by demonstration. The 
demonstration shall be performed with personnel using flight-representative contingency 
breathing apparatus and include communication between individuals and with the CVCC and 
spacecraft. The demonstration shall be performed under expected ambient noise levels. The 
verification shall be considered successful when the demonstration shows that voice 
communications exist between crewmembers and with the CVCC while wearing the contingency 
breathing apparatus under expected ambient noise levels. [V.CTS.043] 


4.3.2.5.4 Emergency Lighting 


The CTS's emergency lighting shall be verified by analysis, test and demonstration. A task 
analysis shall determine the operations required for operational recovery and crew egress, and 
task surfaces required to support those operations. The test shall evaluate task surfaces required 
for operational recovery and emergency crew egress paths in a flight representative vehicle in the 
flight configuration. The test shall perform illumination measurements made on and normal to 
the task surface(s) with a subject positioned to perform the operational tasks, including egress. 
The test shall evaluate automatic activation of emergency lighting by interrupting primary 
vehicle power and measuring elapsed time to activation of emergency lighting. For unpowered 
emergency illumination sources, a demonstration shall be performed with the spacecraft 
emergency egress configuration. The verification shall be considered successful when test 
shows that emergency lighting can be automatically activated and illumination levels support 
operational recovery activities and the demonstration shows that unpowered emergency 
illumination sources support crew egress. [V.CTS.044] 


4.3.2.5.5 Portable Fire Suppression 


The spacecraft's portable fire suppression system shall be verified by inspection, analysis, and 
demonstration. An analysis shall be performed to identify the types and locations of potential 
ignition sources, suppression methods and suppressant for each, and location of access ports for 
portable fire extinguishers. The inspection of drawings and models shall confirm accessibility of 
portable fire suppression in their stowed locations, that any enclosed volume that needs fire 
suppression has a portable fire extinguisher access port to allow fire suppressant to be dispensed 
in it without having to open an access door/panel, that the portable fire extinguisher has adequate 
clearance to interface with the portable fire extinguisher access port, and that the portable fire 
extinguisher has a visual device to verify adequate quantity of fire suppressant in it. Manual 
operation and accessibility of the portable fire suppression system shall be verified by 
demonstration in a flight-representative configuration. The verification shall be considered 
successful when the inspection, analysis, and demonstration shows that portable fire suppression 
equipment is provided in location(s) accessible to crew within | minute in the event of 
emergency. [V.CTS.045] 


4.3.2.5.6 Personal Protective Equipment 


The spacecraft's provision for PPE, including automated PPE, shall be verified through analysis 
and inspection. An analysis shall be performed to identify potential emergency scenarios and 
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their designed control measures that include crew PPE. There will be an inspection of PPE 
stowage locations. The verification shall be considered successful when the analysis and 
inspection show that PPE is provided for each crewmember and is accessible by crew for 
potential emergency events. [V.CTS.046] 


4.3.2.5.7. Fire Detection and Suppression in Isolated Areas 


The spacecraft's fire event detection and fire suppression for the enclosed/isolated areas in the 
pressurized volume shall be verified by analysis, inspection and demonstration. An analysis 
shall be performed to identify the types and locations of potential ignition sources, suppression 
methods and suppressant for each, and placement of detection and suppression equipment. The 
analysis shall show that the spacecraft detects events indicating impending fire and limits 
propagation of the event in the enclosed/isolated areas in the pressurized volume, and that 
enclosed/isolated areas that the crew cannot reach with a portable fire extinguisher have a fixed 
fire suppression system. An inspection of drawings shall be performed to verify that fire event 
detection, and fixed fire suppression hardware are placed in the enclosed/isolated areas in the 
pressurized volume where there is forced air flow and potential ignition sources or credible 
oxygen enrichment/leakage and potential ignition sources. The inspection shall also show that 
the fixed fire suppression hardware provides a means to determine that adequate quantity of fire 
suppressant is available for use by the crew and ground at all times. A demonstration of a 
simulated smoke alarm and vehicle response shall show that a fire event in the enclosed volume 
in the pressurized volume can be detected and suppressed. The verification shall be considered 
successful when the analysis, inspection, and demonstration show that a fire in the 
enclosed/isolated areas in the pressurized volume can be detected and suppressed before it can 
propagate. [V.CTS.047] 


4.3.2.5.8 Locate Spacecraft after Landing 


The ability of the CTS to provide spacecraft location to the recovery/rescue forces after landing 
shall be verified by analysis. The analysis shall be performed to show the spacecraft is capable 
of providing location data in a hatch closed configuration for the landed spacecraft to the 
recovery/rescue forces. The analysis should be able to show that the range of the capability is 
appropriate and consistent with the recovery/rescue force deployment strategy. The verification 
shall be considered successful when the analysis shows the spacecraft is capable of providing 
recovery/rescue forces with its location in a hatch-closed configuration from landing until the 
recovery/rescue forces arrive at its location. [V.CTS.089] 


4.3.2.5.9 Fire Detection in Habitable Cabin 


The spacecraft's cabin fire event detection shall be verified by analysis, inspection and 
demonstration. An analysis shall be performed to identify the types and locations of potential 
ignition sources and the type and placement of detection equipment. An inspection of drawings 
shall be performed to verify that the detection hardware has been installed in the crew habitable 
cabin. A demonstration of a simulated fire shall show that a fire event in the cabin can be 
detected. The verification shall be considered successful when the analysis, inspection and 
demonstration show that a fire event in the habitable cabin can be detected. [V.CTS.349] 


4.3.2.5.10 Protection from Cabin Depressurization 


The CTS's ability to protect each individual crewmember from a depressurized cabin during 
ascent and entry shall be verified by test. All of the following suit tests shall be performed with a 


Commercial Crew Program 
International Space Station Program Page 125 of 295 


ISS Crew Transportation and CCT-REQ-1130 
Services Requirements Document Revision: E-1 


flight representative suit. A test shall be performed to show the suit operates at a minimum 
pressure of 3.5 psia while in a reduced pressure cabin. The test shall be performed with a flight 
representative O2 supply system to show that the suit system provides nominal 100% O2 when 
operated in a depressurized cabin. In addition, tests shall be performed to show that the suit 
limits ppCO2 to less than 5 mm Hg around the face area without violating the cabin nominal 
oxygen concentration limits. The test shall be performed at representative operational metabolic 
rates as shown in Appendix F and at ambient cabin conditions for nominal ascent and entry 
operations to show that the suit limits ppCO2 to less than 5 mm Hg around the face area without 
violating the cabin nominal oxygen concentration limits. The test shall also be performed to 
show that the suit limits ppCO2 to less than 5 mm Hg around the face area when operated during 
reduced cabin pressure. A test of the spacecraft shall be performed to show that the spacecraft 
can provide the necessary resources to the suits to support keeping the ppCO2 levels in the face 
area of the space suit to less than 5 mmHg and provide oxygen to the space suits in a 
depressurized cabin. The verification shall be considered successful when the suit and spacecraft 
tests confirm that the suit operates at a minimum pressure of 3.5 psia, provides nominal 100% 
O2 when operated in a depressurized cabin, limits ppCO2 to less than 5 mm Hg around the face 
area in a depressurized cabin, and limits ppCO2 to less than 5 mm Hg around the face area in a 
nominal cabin environment. [V.CTS.048] 


4.3.2.5.11 Pressure Suits 
4.3.2.5.11.1 Suited Habitable Duration 


The ability of the CTS to provide a sufficient quantity of consumables to sustain life of the 
pressure-suited crew in a depressurized cabin shall be verified by analysis. An analysis shall be 
performed to determine the worst case duration to execute a deorbit, entry, and landing of the 
vehicle. An analysis shall be performed to determine the worst case duration to execute an 
ascent abort at any point along the trajectory. These analyses shall assume no additional CTS 
failures after the depressurization event. The verification shall be considered successful when the 
analysis confirms the CTS provides a sufficient quantity of consumables to sustain life of the 
pressure suited crew for the longest duration of the two scenarios assessed in the duration 
analyses. [V.CTS.322] 


4.3.2.5.11.2 Donning during Leak 


The ability of the suit to provide for unassisted donning and connection to life support shall be 
verified by analysis and demonstration. A task analysis shall be performed to identify all tasks 
required by the crew to complete suit donning and connection to life support without assistance. 
A demonstration shall be performed by a test subject in 1-g using a flight representative suit. 
The verification shall be considered successful when the test subject performs all tasks required 
in the task analysis and successfully dons the suit and connects to life support without assistance. 
[V.CTS.324] 


4.3.2.5.11.3 Suit Communications 


The ability of the suit to provide two-way voice communications between crewmembers and 
crewmembers to the CVCC shall be verified by demonstration. The demonstration shall consist 
of suited test subjects in flight representative suits performing voice checks. The verification 
shall be considered successful when the demonstration shows that the suit provides two-way 
voice communication between the test subjects and between the test subjects and the CVCC. 
[V.CTS.328] 
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4.3.2.5.11.4 Body Waste Management in Suit 


The suit's ability to contain urine and feces shall be verified by inspection. The inspection shall 
consist of a review of suit drawings and flight equipment list. The verification of suit body waste 
management shall be successful when the inspection of suit drawings shows a body waste 
collection system or diapers are included on the flight equipment list. [V.CTS.332] 


4.3.2.5.11.5 Suit Accommodation of Metabolic Loads 


The suit regulation of the crew core body temperature under metabolic loads shall be verified by 
analysis. The analysis shall identify the tasks, flight configurations, and associated metabolic 
rates of each crewmember. The analysis shall evaluate atmospheric ppO2, ppCO2, temperature, 
and relative humidity for all suited phases. The analysis shall evaluate the crew core body 
temperature of suited crewmembers in all flight phases. For contingency scenarios, the thermal 
control system can be assumed to be functional. The verification shall be considered successful 
when the analysis shows that the suit is capable of accommodating the expected metabolic loads 
imposed by the crewmember, per Appendix F, "Metabolic Loads," by maintaining the required 
suited conditions of 3.2.5.10 and crew core body temperatures between 97 °F and 100.5 °F. 
[V.CTS.388] 


4.3.2.5.12 Unassisted Vehicle Egress 


The CTS's provision of unassisted vehicle egress during the pre-launch and post-landing 
timeframe shall be verified by demonstration and analysis. A demonstration of unassisted egress 
shall be performed in a flight-representative vehicle with a full crew complement in their flight 
configuration for pre-launch and post-landing. The demonstration shall begin with the decision 
to egress and exercises all procedures required for egress, such as equalizing pressure across and 
opening the hatch, releasing all restraints, and translating all crew through the hatchway onto 
surfaces representative of both pre-launch and post-landing environments. A demonstration of 
the deployment of the launch pad-to-spacecraft interface system shall be performed to establish 
the time to the first crewmember egress. The verification shall be considered successful when 
the analysis of the demonstration results confirms that all the crewmembers can egress the 
vehicle in 90 seconds from the decision to egress. [V.CTS.087] 


4.3.2.6 Software 
4.3.2.6.1 Manually Override Software 


The integrated space vehicle manual override capability for the automation system shall be 
verified by analysis and demonstration. A functional allocation analysis will identify the 
automated tasks to be performed by the flight software. Hazard analyses will identify which 
automated tasks can be overridden without directly causing a catastrophic event. The 
demonstration shall be performed using flight-configuration software and a list of automated 
tasks. The demonstration shall involve engaging the automated system and having a human 
operator manually override each automated task identified in the functional allocation analysis. 
The verification shall be considered successful when the demonstration shows that all identified 
automated tasks can be manually overridden by a human operator. [V.CTS.050] 


4.3.2.6.2 Manually Override Software - Post-Separation 


The spacecraft's manual override capability for the automation system shall be verified by 
analysis and demonstration. A functional allocation analysis will identify the automated tasks to 
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be performed by the flight software. Hazard analyses will identify which automated tasks can be 
overridden without directly causing a catastrophic event. The demonstration shall be performed 
using flight-configuration software and a list of automated tasks. The demonstration shall 
involve engaging the automated system and having a human operator manually override each 
automated task identified in the functional allocation analysis. The verification shall be 
considered successful when the demonstration shows that all identified automated tasks can be 
manually overridden by a human operator. [V.CTS.370] 


4.3.2.6.3 Autonomous Operation of System 


The autonomous operation of system and subsystem functions shall be verified by analysis and 
test. A functional analysis shall determine the critical functions for integrated space vehicle 
operation. The test shall confirm that the critical functions defined by the functional analysis can 
be regulated without input from the CVCC. The verification shall be considered successful 
when the analysis and test shows critical functions require no inputs from the ground for nominal 
or contingency operations. [V.CTS.05 1] 


4.3.3, Pre-Launch/Ascent 
4.3.3.1 Pad and Ascent Aborts 
4.3.3.1.1 Detect and Initiate Abort 


The detection and automatic initiation of an abort shall be verified by analysis and test. Safety 
analysis shall be used to identify the failure modes for which the monitoring system will be 
required to detect and initiate an abort to meet LOC requirements. The analysis shall identify 
detection and confirmation methods including the maximum detection latency times for each 
failure. The test shall be conducted using flight representative hardware and flight software for 
the launch vehicle, spacecraft, abort systems, and interfaces to ground systems. The test shall 
include worst case latency during pad and ascent flight phases and exercise all abort triggers. The 
tests shall determine the performance of the detection system and abort initiation logic. The 
verification shall be considered successful when the analysis shows, for identified failure modes, 
the space vehicle is able to detect the need for an abort with sufficient time for the crew to depart 
prior to catastrophic failure. [V.CTS.057] 


4.3.3.1.2 Determine Abort Mode 


The automatic selection of abort modes by the spacecraft shall be verified by analysis. The 
analysis shall be performed using primary flight software. The analysis shall include the 
conditions throughout the ascent flight phase and for different types of ascent aborts. The 
analysis shall include both nominal and off-nominal ascent trajectories to the ISS. The 
verification shall be considered successful when the analysis shows that the probability is at least 
99.865% with 90% confidence that the spacecraft automatically selects the correct abort mode 
for the conditions. [V.CTS.056] 


4.3.3.1.3 Pad Abort 


The CTS's pad abort capability requirement shall be verified through test and analysis. The tests 
shall determine the performance of the abort logic and abort flight systems. Analysis shall 
include verified 6DOF simulations, including appropriate modeling of all systems affecting pad 
abort dynamics, along with their uncertainties. The Monte Carlo will simulate the spacecraft's 
entire abort trajectory from abort initiation through landing location. The abort capability shall 
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be considered successful for each analysis if the aborting spacecraft demonstrates controllability, 
no near-field re-contact with the launch vehicle or ground infrastructure, operation within 
hardware thermal constraints, human capability constraints, structural loads limits, and ability to 
achieve acceptable landing. The verification shall be successful when a Monte Carlo simulation 
of the required abort scenario with environmental and spacecraft dispersions achieve a 95% 
probability of success with at least 90% confidence. This does not cover assessment of 
catastrophic conditions assessed by the LOC analysis in requirement 3.2.1.1. [V.CTS.055] 


4.3.3.1.4 Ascent Abort 


The continuous launch abort capability requirement shall be verified through test and analysis. 
Safety Analysis establishes the failure initiators and the time period(s) during ascent for which 
they are credible. The tests shall determine the performance of the detection system, abort logic, 
and abort flight systems. Analysis shall include verified 6DOF simulations, including 
appropriate modeling of all systems affecting vehicle and launch abort dynamics, along with 
their uncertainties for all appropriate flight phases. The Monte Carlo will insert the launch 
vehicle failures in a random fashion, uniformly through-time, throughout the ascent trajectory. 
Note — failure initiators can be selected assuming a uniform probability distribution during the 
time periods for which they are credible or based on documented probabilistic analysis. The 
Monte Carlo will simulate the spacecraft's entire abort trajectory from abort initiation through 
landing location or achievement of a stable orbit (for abort-to-orbit cases). This includes vehicle 
rotation rates during launch vehicle loss of control and changes in acceleration due to launch 
vehicle loss of thrust. The abort capability shall be considered successful for each analysis if the 
aborting spacecraft demonstrates controllability, no near-field re-contact with the launch vehicle, 
increasing spacecraft inertial velocity during abort motor burns that initiate during transonic 
(max spacecraft drag) and high dynamic pressure conditions, operation within: hardware thermal 
constraints, human capability constraints, structural loads limits, and ability to achieve 
acceptable landing. The verification shall be successful when a Monte Carlo simulation of the 
required abort scenarios with environment, launch vehicle, and spacecraft dispersions, in time 
bins no larger than 10s each, achieves a 95% probability of success with at least 90% confidence 
for each time bin throughout the ascent profile. This does not cover assessment of catastrophic 
conditions assessed by the LOC analysis in requirement 3.2.1.1. 


See CCT-STD-1140, "Flight Mechanics and GN&C Technical Assessment" section for technical 
verification expectations pertinent to flight mechanics. [V.CTS.058] 


4.3.3.1.5 Ascent Abort Reliability 


The abort system reliability shall be verified by analysis. The verification shall be considered 
successful when the calculated hardware and software reliability of the abort system from the 
abort subsystem initiation command until abort systems operations are no longer active exceeds 
0.995. [V.CTS.059] 


4.3.3.1.6 RESERVED 
4.3.3.1.7  Aborts outside DAEZ 


The ability of the CTS to provide ascent aborts that result in landing outside the DAEZ shall be 
verified by analysis. The verification shall be considered successful when the abort analysis, in 
support of verification 4.3.3.1.4, shows that the spacecraft is capable of landing outside the 
DAEZ for all abort initiation times. [V.CTS.061] 
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4.3.3.1.8 Abort without Launch Vehicle Thrust 


The CTS's performance of a pad and ascent abort that separates the spacecraft from the launch 
vehicle without relying on thrust from the launch vehicle shall be verified by analysis. The 
verification shall be considered successful when the abort analyses, in support of verifications 
4.3.3.1.3 and 4.3.3.1.4, show that separation is achieved without relying on launch vehicle thrust 
for all pad and ascent abort conditions. [V.CTS.062] 


4.3.3.1.9 Abort on Flight Termination System Command 


The abort on FTS command with adequate time delay shall be verified by analysis and test. The 
analysis shall evaluate all system latencies associated with the abort (communication latency, 
abort system thrust ramp-up, etc.). Relative motion and debris analysis of an FTS initiated-abort 
with time delay shall be performed to verify re-contact and debris strike risks are minimized 
commensurate with the Loss of Crew Risk Requirement 3.2.1.1. Tests shall be performed using 
flight representative hardware and flight software under simulated flight conditions for defined 
destruct criteria/scenarios negotiated with the range. The verification shall be considered 
successful when the crewed space vehicle automatically initiates the ascent abort sequence on 
receipt of an FTS command with automatic abort system, both enabled and manually inhibited. 
[V.CTS.063] 


4.3.3.1.10 Initiate Pad and Ascent Abort 


The capability of the crew and the CVCC to initiate the pad and ascent abort sequence shall be 
verified by test. For each possible abort mode, during pad operations and ascent, the test shall 
confirm the commanded abort sequence from both the crew interface and ground interface. 
Verification that downlink data and uplink abort commands are successfully transmitted is 
confirmed by closure of requirements 3.7.1 and 3.8.1.2. The verification shall be considered 
successful when the response to the abort command is initiation of the appropriate abort 
sequence for the given trajectory and vehicle performance conditions. [V.CTS.064] 


4.3.3.2 Emergency Pad Egress 
4.3.3.2.1 Detect Emergency Pad Egress 


The ability of the CTS to detect and alert the CVCC of conditions requiring an emergency pad 
egress shall be verified by test and analysis. Safety analysis shall identify the conditions the CTS 
shall detect and alert the CVCC of those hazards that require an emergency pad egress. The test 
shall be performed for each unique detection system by simulating the conditions requiring an 
emergency pad egress using flight representative software and hardware in a flight configuration. 
The verification shall be considered successful when the test shows all conditions identified in 
the safety analysis can be detected by each detection system and those detection systems have 
the ability to alert the CVCC of conditions requiring emergency pad egress. [V.CTS.065] 


4.3.3.2.2 Ground and Flight Crew Emergency Pad Egress 


The ability of the CTS to provide for ground and flight crew emergency egress during hazardous 
pre-launch activities shall be verified by demonstration and analysis. The hazard analysis shall 
determine the time to effect for each emergency egress scenario throughout the countdown and 
the effectiveness of the designated safe location and pre-coordinated collection point. These 
emergency egress scenarios start from the completion of crew egress at the spacecraft hatch 
interface and end with the securing of the last individual at the pre-coordinated collection point 
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outside the blast danger area. Each segment of an emergency egress scenario shall be 
demonstrated in the flight configuration with emergency systems active. The verification shall be 
considered successful when the analysis and demonstration of the operational system shows that 
ground and flight crew egress can be achieved in the response times as determined by the hazard 
analysis for each scenario. [V.CTS.066] 


4.3.3.3 Range Safety 
4.3.3.3.1 Alert Crew of Flight Termination 


The integrated space vehicle's ability to alert the crew upon receipt of arm and destruct FTS 
command shall be verified by demonstration. The demonstration shall be performed with flight 
software and flight representative hardware and an emulated FTS command. The verification 
shall be considered successful when the demonstration shows the crew has been alerted to the 
receipt of an arm and destruct FTS command. [V.CTS.069] 


4.3.3.3.2 Range Safety Program Compliance 


The CTS's compliance with NPR 8715.5A Range Flight Safety Program shall be verified by 
inspection and analysis. The analysis shall identify all design and operational constraints 
imposed by NPR 8715.5A and their allocation to CTS design and production elements. The 
verification shall be considered successful when the inspection shows that allocated CTS design 
and production elements have met NPR 8715.5A. [V.CTS.350] 


4.3.3.4 Launch Support System 
4.3.3.4.1 Protection from Lightning 


The ability of the CTS to prevent direct attachment of lightning channels to the integrated space 
vehicle while on the ground shall be verified by analysis. The verification shall be considered 
successful when the analysis of the operational plans and lightning protection system design 
shows that the integrated space vehicle is protected from direct lightning attachment while on the 
ground with 95% or greater probability of success with 90% confidence. [V.CTS.073] 


4.3.3.4.2 Accommodate NASA Personnel at CVCC 


The ability of the CTS to provide CVCC accommodations for mission essential NASA personnel 
shall be verified by inspection. The inspection shall include a review of CTS systems, including 
facilities, communications (voice loops, telephones, etc.), CVCC console displays, network 
access, and telemetry to show that the NASA designated consoles support the real-time 
monitoring and ability to communicate with NASA personnel in ISS MCC-H. The verification 
shall be considered successful when an inspection shows the CVCC accommodations for 4 
mission-essential NASA personnel are in place. [V.CTS.071] 


4.3.4 Onorbit 
4.3.4.1 Contingency 
4.3.4.1.1| Emergency Return from ISS 


The CTS's provision for emergency return within 24 hours shall be verified by analysis and 
inspection. Analysis shall assume nominal spacecraft systems function and nominal 
consumables when the emergency event occurs. Analysis shall be performed to evaluate 
spacecraft power-up timelines, crew ingress into the spacecraft, hatch closure, and departure 
timelines. The analysis shall vary ISS altitudes per SSP 50808 3.3.3.2.18, ISS Attitude and Orbit 
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Constraints, and departure times through a 1 month timeframe. An inspection shall review the 
process to choose emergency landing sites during any 24 hour period that minimizes the time 
from the emergency return decision until crew rescue and transport to a definitive medical care 
facility. This process shall also account for notification of agencies involved in the landing 
operations and subsequent rescue. The verification shall be considered successful when the 
analysis and inspection shows that the CTS can accomplish the mission planning, spacecraft 
ingress, departure operations, landing site selection, notification of agencies involved in the 
landing and rescue, and subsequent landing from any point in the ISS-mated portion of the 
mission within 24 hours. 


See CCT-STD-1140, "Flight Mechanics and GN&C Technical Assessment" section for technical 
verification expectations pertinent to flight mechanics. [V.CTS.106] 


4.3.4.1.2 Undock without ISS Services 


The ability of the spacecraft to perform undocking and separation operations without services 
from the ISS shall be verified by analysis. Analysis in the form of modeling and simulation, as 
well as review of operational procedures and functions, shall be performed to verify that the CTS 
mission profile and spacecraft are capable of all undocking and separation without aid from the 
ISS. The verification shall be considered successful when the analysis shows that the spacecraft 
has the system performance necessary to perform undocking and separation operations without 
any supporting services from the ISS vehicle. [V.CTS.076] 


4.3.4.1.3 Autonomous Deorbit 


The spacecraft's capability to autonomously target and perform a deorbit, entry, and landing, 
starting with orbit insertion, shall be verified by test and analysis. A safety analysis is utilized to 
determine the failure scenarios that require an emergency return, along with the time required 
from the initiation of the failure to landing, in order to provide for the safe return of the crew. 
An operational analysis shall be performed to determine the tasks required to deorbit, enter, and 
land to a supported landing site. A functional analysis shall be performed to determine the 
system performance necessary to perform the autonomous targeting and execute the deorbit, 
entry, and landing. A test shall be performed using flight software and flight representative 
hardware to evaluate the system performance and capability to autonomously target landing 
opportunities. The verification shall be considered successful when the analysis and test show 
the spacecraft has the capability to autonomously target, deorbit, enter, and land at provider- 
designated landing sites. [V.CTS.086] 


4.3.4.2 Spacecraft Operations and Durations 
4.3.4.2.1_ Docking 24 hours after Launch 


The CTS's ability to dock 24 hours after launch shall be verified by analysis. For the purposes of 
this verification, "docking" is defined as the planned first contact between the docking 
mechanisms. The verification shall be considered successful when the analysis in support of 
verification 4.3.1.2.1 shows that the CTS spacecraft docks to ISS within the docking contact 
conditions 24 hours +/- | hour after launch and when the rendezvous phase window is at least 
190 degrees. [V.CTS.078] 
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4.3.4.2.2 Multiple Approach Attempts 


The spacecraft's ability to perform an additional approach and docking attempt 90 minutes after 
the initial attempt from an operationally-safe standoff distance shall be verified by analysis. A 
statistical analysis shall determine the vehicle state (position and attitude) dispersions, system 
performance, and consumables required to accomplish the additional attempt. For the purposes 
of this verification, "docking" is defined as the planned first contact between the docking 
mechanisms. The verification shall be considered successful when the analysis shows at least 
99.73% with 90% confidence of the cases dock within the docking contact conditions on the 
second attempt at least 90 minutes after the initial attempt. [V.CTS.079] 


4.3.4.2.3. Support Docking Delay 


The spacecraft's ability to dock 24 hours after the initial docking attempt shall be verified by 
analysis. A statistical analysis shall determine the vehicle state (position and attitude) 
dispersions, system performance, and consumables required to accomplish the 24 hour delay. 
For the purposes of this verification, “docking” is defined as the planned first contact between 
the docking mechanisms. The verification shall be considered successful when the analysis 
shows at least 99.73% with 90% confidence of the cases dock within the docking contact 
conditions. [V.CTS.080] 


4.3.4.2.4 Support Deorbit Delay 


The spacecraft's capability to allow for a minimum of 24 hours delay past the nominal deorbit 
burn shall be verified by analysis. Analysis in the form of modeling and simulation shall be 
performed to verify that the CTS mission profile and spacecraft shall have sufficient 
consumables and other resources to allow (at all times during the mission) for a 24 hour delay 
following a deorbit waive-off. Verification shall be considered successful when the analysis 
shows that the spacecraft capability and the performance of the planned mission profile allow for 
a minimum of a 24 hour delay and still maintain the capability to deorbit after that timeframe. 
[V.CTS.081] 


4.3.4.2.5 ISS Safe Haven 


The spacecraft's safe haven capability while docked to the ISS with the hatch-closed for all 
crewmembers returning with the spacecraft shall be verified by analysis. The analysis shall 
include spacecraft consumables availability and margins, spacecraft functionality to supply the 
consumables in time to provide a safe haven, and the operational procedures for the safe haven 
contingency. The verification shall be considered successful when the analysis shows that the 
spacecraft can provide functionality and consumables (including spacecraft power, life support 
resources, and other commodities required to ensure crew survivability) to satisfy the safe haven 
requirement. [V.CTS.082] 


4.3.4.2.6 Alternate Landing Site 


The ability of the CTS to return NASA ISS crew to an alternate landing site shall be verified by 
analysis and inspection. A functional analysis shall be performed to determine the ground 
system capabilities required at the landing site. The verification shall be considered successful 
when analysis of ground system capabilities and the inspection of drawings, equipment lists, and 
landing site features determine that ground system capabilities are available throughout the 
landing site. [V.CTS.337] 
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4.3.4.2.7 Return after Failure to Dock 


The spacecraft’s early return to a supported landing site following a failure to mate with the ISS 
on the final attempt after the 24 hour contingency re-rendezvous shall be verified by analysis. 
The statistical analysis extends the statistical analysis performed for 4.3.4.2.3. The analysis will 
evaluate crew timelines and landing opportunities, along with necessary consumables to perform 
the separation out to a safe deorbit location, perform the deorbit, and land at the supported site. 
Analysis will also include waiving-off the deorbit maneuver per 3.4.2.4. and 3.4.2.6. The 
verification shall be considered successful when the analysis shows that in 95% of the cases with 
90% confidence, the spacecraft can accomplish the mission planning and the spacecraft has 
adequate consumables to complete the mission for all cases where rendezvous failed per 3.4.2.3. 
[V.CTS.338] 


4.3.4.2.8 Integrated System Performance with Final Successful Rendezvous 


The spacecraft's integrated system performance for completing required operations shall be 
verified by analysis. A statistical integrated system performance analysis shall be performed 
using the ISS altitude band described in 4.3.4.2.1 to determine consumables utilization beginning 
when ground services are terminated pre-launch, through docking at the most-stressing docking 
port, 210 days of docked operations, and ending with landing, while accommodating all specified 
contingency operations listed in this requirement. The simulation shall determine consumables 
required for system duty cycles assuming nominal systems performance based on dispersions on 
mass properties, engine, and subsystem performance, GN&C parameters, and environmental 
parameters. The verification shall be considered successful when 95% (with 90% confidence) of 
the analyzed missions have consumables to complete the mission. [V.CTS.375] 


4.3.4.3 Orbital Debris 
4.3.4.3.1 Expendable Module Disposal 


The verification of the disposal of expendable modules and other orbital debris shall be done by 
inspection and analysis. The atmospheric reentry risk analysis shall be utilized to show 
compliance with the human casualty risk criteria. The verification shall be considered successful 
when the inspection shows that mission design and CTS hardware have met NASA-STD- 
8719.14. [V.CTS.083] 


4.3.4.3.2 Collision Avoidance 


The CTS's capability to perform collision avoidance shall be verified by analysis and 
demonstration. Analysis shall be performed to show that launch can be delayed or an orbital 
maneuver can be executed to avoid a close encounter with orbital debris. Analysis shall also be 
performed to show that valid state covariance data can be produced in support of the Probability 
of Collision (Pc) method. Demonstration with integrated end-to-end simulations shall be 
performed to show that the CTS successfully executes the collision avoidance process with 
trackable orbital debris. The verification shall be considered successful when the analysis and 
demonstration show that CTS has the capability to produce valid state covariance data and insert 
maneuvers in the sequence to avoid collision with orbital debris during pre-launch and onorbit 
free-flight operations. [V.CTS.084] 
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4.3.5 Entry/Landing Requirements 
4.3.5.1 Nominal 

4.3.5.1.1 RESERVED 

4.3.5.1.2 Assisted Vehicle Egress 


The ability of the CTS to accommodate assisted crew egress of the entire crew in the pre-launch, 
post-landing, and contingency configurations and environments (reference 3.5.2.2 and 3.5.2.3) 
shall be verified by analysis and demonstration. A hazard analysis shall be utilized to 

identify which pre-launch, post-landing, and contingency configurations and conditions will 
drive conditions for assisted egress. The enveloping cases will be the basis for demonstration. 
The demonstration shall be performed in a flight-representative vehicle in flight configuration 
with a full crew complement and planned close-out, recovery, and rescue personnel. The 
Demonstration shall exercise all procedures and equipment to prepare and egress crew from the 
spacecraft with ground personnel assistance through all designated egress paths. Modeling 
analysis may be performed to supplement demonstrations. The verification shall be considered 
successful when the demonstration confirms ground crews can open the hatch from the outside, 
release the crew from the restraint system, and assist the entire crew in egressing the vehicle in 
pre-launch, landing, and contingency environments. [V.CTS.344] 


4.3.5.1.3 Visual Aids for Search and Rescue/Recovery 


The spacecraft's provisioning of visual aids for search and rescue/recovery in all ambient lighting 
conditions shall be verified by demonstration and analysis. For strobe lights/beacons, a 
demonstration shall be conducted using flight representative hardware that simulates the proper 
height, attitude, and obscurations (e.g. uprighting bags, deployed mechanisms needed for 
landing, position of waterline, etc.) of the spacecraft. This demonstration shall include viewing 
the test article from multiple heights of ground level, 500 feet, 1000 feet, 1500 feet, and 2000 
feet altitudes at a minimum distance of 3 nautical miles during night and day Visual 
Meteorological Conditions (VMC). An analysis shall be conducted to determine that the 
spacecraft, any associated color markings, and any deployed visual markers provide sufficient 
color contrast with the surrounding landing terrain to allow rescue forces to locate the spacecraft 
in daylight from a minimum distance of 3 nm during VMC. The verification shall be considered 
successful when the demonstration shows that an observer can locate the spacecraft at a distance 
of 3 nautical miles from all demonstrated heights, lighting conditions, and angles during VMC, 
and that the analysis shows that the spacecraft, any associated color markings, and any deployed 
visual markers provide sufficient color contrast with the surrounding landing terrain to allow 
rescue forces to locate the spacecraft in daylight from a minimum distance of 3 nm during VMC. 
[V.CTS.088] 


4.3.5.1.4 Post-Landing Crew Services 


The CTS's provision of 2 hours of post-landing services after touchdown shall be verified by 
inspection and analysis. An operational analysis shall be performed to determine the post- 
landing crew tasks required to safe the vehicle and prepare for a recovery at a supported site. A 
performance analysis of CTS elements shall be performed to evaluate the functions and 
consumables required to provide a breathable atmosphere and crew cooling. An inspection of 3- 
D models shall determine the location of post-landing drinking water. The verification shall be 
considered successful when the analysis shows the CTS can maintain a breathable atmosphere 
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per 3.10.11.1.1b,d, and accommodation of metabolic loads per 3.2.5.11.5 for 2 hours post- 
landing and the inspection shows the drinking water is within the range of motion of the 
crewmember in the landed configuration. [_V.CTS.090] 


4.3.5.1.5 Orthostatic Protection 


The CTS's provisioning of crewmember orthostatic protection shall be verified by test. The test 
shall be performed with human subjects that represent the current male and female astronaut 
population range, and shall measure pressures applied by the flight suit to the calf, thigh, and 
abdominal segments of the body. The verification shall be considered successful when the test 
shows that the garment applies a mean pressure between 40 mmHg and 80 mmHg to the lower 
body segments. If pressures are graded, the garment shall apply the highest pressure at the 
foot/ankle with pressures decreasing up the leg, and lowest pressure over the abdomen to the 
level of the diaphragm. [V.CTS.091] 


4.3.5.1.6 Crew Egress Paths 


The CTS's ability to provide more than one crew egress path out of the spacecraft when in the 
landing configuration shall be verified by analysis and demonstration. Analysis shall be 
performed on engineering drawings and schematics to ensure that the spacecraft design has 
provided a post-landing alternate egress path for crewmembers in their entry clothing and 
equipment. Analysis on alternate egress hatch configuration, volume for crew maneuvering, and 
ability to open an alternate egress hatch with the crew in their normal entry configuration will be 
completed. A demonstration utilizing flight representative hardware and the required egress 
procedures shall be performed by crewmembers in the planned entry configuration, and nominal 
and off nominal vehicle orientations required for use of the alternate egress path. The 
verification shall be considered successful when the analysis of engineering data and 
demonstration results sufficiently document the ability to support crew egress through the 
alternate egress path for nominal and select off nominal spacecraft landing attitudes. 
[V.CTS.092] 


4.3.5.1.7_ Communications with CVCC after Landing 


The spacecraft-provided two-way voice communication between the crew and the CVCC until 
crew disembarkation shall be verified by analysis and demonstration. The analysis shall be 
performed on the end-to-end communications path including radio device/equipment, spacecraft 
connection/cabling, spacecraft communications systems, and the CVCC communication 
equipment to satisfy a minimum of 2 hours talk time duration with CVCC after landing. A 
demonstration shall be performed to show the post-landing communications system, in a hatch 
closed configuration, can communicate with the CVCC. The demonstration shall be performed 
in environments representative of both supported and unsupported landing sites. The 
verification shall be considered successful when the demonstration shows the system can 
communicate between the crew in the spacecraft and the CVCC and the analysis shows 
communications can be maintained for a cumulative 2 hours over a 24 hour period. [V.CTS.095] 


4.3.5.1.8 Spacecraft Voice Communication with Recovery/Rescue Forces 


The spacecraft's crew communication with recovery/rescue forces until crew disembarkation 

shall be verified by analysis. The analysis shall be performed on the requirements and design of 
the vehicle, vehicle communications systems including portable devices, and the recovery/rescue 
forces communication equipment to verify that the spacecraft crew communication system to the 
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recovery/rescue forces has sufficient power to operate continuously for a minimum of 4 hours, 
that the frequencies utilized by the crew and recovery forces are identical, that the crew can 
maintain communication with the recovery/rescue forces with the spacecraft egress hatches 
closed, and that the crew can communicate with rescue forces on IAD and MAD frequencies. 
The verification shall be considered successful when the analysis shows that communication 
between the crew in the spacecraft and the recovery/rescue forces can be maintained for a 
minimum of 4 hours, which is the time assumed for the crew to disembark the spacecraft. 
[V.CTS.353] 


4.3.5.2 Contingency 
4.3.5.2.1_ Emergency Entry Capability 


The CTS's emergency systems for entry, descent, and landing (EDL) shall be verified by analysis 
and inspection. A crew survivability analysis shall be performed to select specific capabilities 
that could provide the crew an opportunity for survival in the event that the failure tolerance 
designed into the system is unsuccessful in controlling a potentially catastrophic hazard during 
EDL. The provider methodology, process, and plans for conducting the crew survivability 
analysis shall be consistent with CCT-PLN-1120 Section 4.2. An inspection shall be performed 
to ensure that the selected emergency systems are implemented in the CTS design. The 
verification shall be considered successful when the crew survivability analysis is complete and 
the inspection shows the CTS design includes the EDL emergency systems that provide the crew 
an opportunity for survival. [V.CTS.096] 


4.3.5.2.2 Sea State Landing Limits for Aborts 


The spacecraft's ability to function after water landing following an abort shall be verified by 
analysis. The analysis shall determine the worst-case water landing conditions for aborts based 
on dispersed atmosphere and sea state environments. These conditions are combined with the 
rescue design limitations defined in Figure 3.5.2.2-1 to form the basis of the analysis of 
spacecraft impact conditions with the water. The analysis shall use initial conditions based on 
spacecraft attitude motion during terminal descent, and the spacecraft shall impact the water with 
various wave slopes. An analysis shall be performed to identify systems that must function post- 
landing. The verification shall be considered successful when analysis confirms the spacecraft is 
able to structurally sustain the impact, with necessary spacecraft systems functional after impact. 
[V.CTS.373] 


4.3.5.2.3. Runway Landing Weather Limits for Aborts 


The spacecraft's ability to perform abort runway landings at the environmental limits shall be 
verified by analysis. The analysis shall consist of landing simulations using flight-representative 
software and validated mathematical models for GN&C hardware and flight control systems. 
The verification shall be considered successful when the analysis shows the spacecraft can 
perform the entire landing phase within design limits, landing intact and stopping on the runway, 
while satisfying the conditions in Table 3.5.2.3-1. [V.CTS.374] 


4.3.5.2.4 Crew Survival after Emergency Landing 


The spacecraft's provision for post-landing crew survival shall be verified by a crew survivability 
analysis, as defined in Section 4.2 of CCT-PLN-1120. The analysis shall define operational 
concepts, environments, spacecraft performance, and crew supplies necessary to support the 
crew for 24 hours after landing. An analysis shall evaluate the crew core body temperature 
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based on the tasks and environment. The verification shall be considered successful when the 
analysis shows the spacecraft and portable equipment performance meet that required by the 
survivability analysis and the analysis shows core body temperature excursions above 100.5 °F 
but no greater than 102.6 °F are limited to less than 45 minutes cumulative, with the 
demonstrated system performance. [V.CTS.093] 


4.3.5.2.5 Spacecraft Ventilation for Emergency Landings 


The spacecraft's provision of post-emergency landing ventilation shall be verified by test and 
analysis. The test shall be performed with a flight representative cabin and ventilation system. 
The analysis shall determine the energy required to power the ventilation system commensurate 
with the crew survivability analysis. The verification shall be considered successful when the 
test shows 4 equivalent cabin air exchanges per crewmember per hour are achieved and the 
analysis shows sufficient power available post-landing to operate the ventilation system until 
crew egress. [V.CTS.364] 


4.3.5.2.6 Crew Survival Kit 


The spacecraft's provision of a crew survival kit shall be verified by inspection. The inspection 
shall identify the equipment and supplies present in the manifested survival kit are consistent 
with those determined by the crew survivability analysis developed in 4.3.5.2.4. The verification 
shall be considered successful when the inspection shows a crew survival kit supports all 
crewmembers for at least 24 hours following an emergency landing. [V.CTS.094] 


4.3.5.2.7 Support Crew Rescue After Emergency Landing 


The CTS shall verify the support for rescue of the flight crew by NASA-designated rescue forces 
in the event of an emergency landing at an unsupported landing site by analysis and inspection: 


a. An analysis shall be performed to identify any spacecraft-specific emergency rescue 
equipment required. There will be an inspection of emergency rescue equipment stowed on the 
spacecraft and provided to the NASA-designated rescue forces. 


b. An analysis shall be performed to identify any CTS-specific emergency rescue training and 
training aids required. There will be an inspection of the CTS-specific emergency rescue 
training curriculum and training aids to be provided to the NASA-designated rescue forces. 


c. An analysis shall be performed to determine the range and capabilities of CTS assets and 
resources planned for supported landings. 


The verification shall be considered successful when the analysis and inspection show that the 
required spacecraft-specific emergency rescue equipment has been identified and sufficient 
quantities have been provided and that the CTS-specific emergency rescue training has been 
identified and developed and the capabilities of the CTS assets and resources available to support 
NASA-designated rescue forces are identified. [V.CTS.393] 


4.3.5.3 Post-Landing Recovery 
4.3.5.3.1 Recovery after Nominal Landing 


The ability of the CTS to provide recovery of the flight crew within 1 hour after landing at each 
supported landing site shall be verified by inspection and demonstration. The inspection shall 
review the nominal landing recovery timeline. A demonstration shall be performed to show that 
the personnel, facilities, facilities systems, and GSE are able to successfully recover the flight 
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crew through assisted vehicle egress within 1 hour after landing at each supported landing site. 
The verification shall be considered successful when the inspection and demonstration show the 
CTS is capable of successfully recovering the flight crew within | hour after landing at each 
supported landing site. [V.CTS.097] 


4.3.5.3.2 RESERVED 
4.3.5.3.3 RESERVED 
4.3.5.3.4 RESERVED 
4.3.5.3.5 Recovery Lighting at Supported Sites 


The ability of the CTS to perform recovery operations independent of all ambient lighting 
conditions shall be verified by analysis. The analysis shall include a review of CTS systems 
required to enable recovery operations during any ambient lighting conditions and can show that 
the flight systems, facility systems, and GSE will operate independent of all ambient lighting 
conditions for recovery operations at supported sites. Systems to be considered include tracking 
(optics and radar), recovery/rescue aids, imagery (ground and flight based), GSE, and facilities. 
The verification shall be considered successful when the analyses show that the flight and ground 
systems are capable to support recovery of flight elements independent of all ambient lighting 
conditions at supported sites. [V.CTS.101] 


4.3.5.3.6 NASA Personnel Accompanying Recovery 


The ability of the CTS to transport and deliver 30 NASA personnel and their equipment from a 
CTS-designated staging location to the supported landing site shall be verified by inspection. The 
inspection shall include a review of the transportation plan to verify transportation, 
accommodation, and delivery of 30 NASA personnel and their equipment from a mutually 
agreed CTS-designated staging location to the supported landing site. The verification shall be 
considered successful when the inspection shows that the transportation plan can accommodate 
all NASA personnel and their equipment that will be used during recovery operations in time to 
support the landing. [V.CTS.102] 


4.3.5.3.7 Transport NASA Personnel and Cargo from Landing Site 


The ability of the CTS to provide transportation and delivery of the NASA crew, returning time- 
critical cargo, additional 30 NASA personnel, and equipment to a Continental U.S. airport within 
2 hours of the completion of the NASA medical assessment shall be verified by inspection. The 
inspection shall include a review of the transportation plan to verify transportation, 
accommodations appropriate for delivery of NASA deconditioned crew based on the landing site 
conditions, returning time-critical cargo, 30 NASA personnel and their equipment from a 
supported landing site to a Continental US Airport using CTS resources. An inspection shall 
review verification closure of SSP 50833, Section 3.1.1. The verification shall be considered 
successful when the inspection shows that the CTS is capable of providing transportation and 
delivering NASA crew, 30 NASA personnel, equipment, and time-critical cargo while 
maintaining cargo services per applicable sections of 50833, from the supported landing site to a 
Continental U.S. airport within 2 hours of the completion of the NASA medical assessment using 
air transportation or transportation appropriate to landing site conditions. [V.CTS.103] 
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4.3.5.3.8 Contingency Medical Evacuation 


The ability of the CTS to provide medical evacuation to ill or injured crewmembers to a DMCF 
within | hour of crew egress shall be verified by analysis and demonstration. The analysis shall 
include a review of a medical evacuation plan, showing: 


a. That specifications of the transportation method to be used are appropriate for deconditioned 
crew and landing site conditions, 


b. Accommodation of the correct number of personnel per vehicle, 


c. The personnel certifications, equipment, procedures, and communication necessary for 
medical evacuation at each supported landing site. 


d. A demonstration shall be performed to determine re-entry clothing (e.g. suits) compatibility 
with medical evacuation equipment (e.g. stretcher). The verification shall be considered 
successful when the analysis of the medical evacuation plan and the demonstration show that 
all ill or injured crewmembers, the required number of qualified ATLS Physicians and 
Paramedics, and two additional NASA personnel can be transported to a DMCF within 1 
hour of crew egress. [V.CTS.104] 


4.3.6 Crew Health Support 
4.3.6.1 RESERVED 
4.3.6.2 Medical Hardware Interfaces 


The spacecraft's delivery of medical oxygen through a reserved port shall be verified through 
analysis, inspection, and test. The analysis shall determine the consumables required to support 
the injured crewmember for the duration of the crew return until egress without violating the 
oxygen concentration requirements, per 3.10.11.2.2 and without reducing services to the other 
crewmembers. An inspection of consumables budgets shall determine the consumables are 
available for this operation. The test shall determine the delivery pressure and maximum flowrate 
through the port to the intended respiratory equipment, while the system is supplying nominal 
services to the other crewmembers. The verification shall be considered successful when the test 
results show that oxygen can be delivered per Table 3.6.2 without violating the oxygen 
concentration requirements, per 3.10.11.2.2 and without reducing services to the other 
crewmembers, and the inspection and analysis determines consumables are budgeted for the 
required duration. [V.CTS.318] 


4.3.6.3 Privacy of Health and Medical Data 


The CTS's provision of ensured privacy of all crew health and medical data shall be verified by 
analysis and inspection. The analysis shall assess the collection, transmission and storage of 
medical data. The inspection shall review the command and control architecture against the 
unintentional access and distribution of crew medical and personal data. The verification shall 
be considered successful when the analysis and inspection show that the ground command and 
control architecture ensures the secure collection, transmission, storage and access to this data. 
[V.CTS.107] 


4.3.6.4 Health Stabilization 


The requirement to meet JSC 22538 shall be verified by analysis. The analysis shall evaluate 
operational plans and controls to ensure that non-NASA flight crew, mission-related personnel, 
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facilities, procedures, and employee training reduce the risk that the crew will be exposed to 
communicable disease prior to the mission. The verification shall be considered successful when 
the analysis of CTS HSP plans and procedures shows that measures are in place to meet JSC 
22538, Flight Crew Health Stabilization Program. [V.CTS.109] 


4.3.7 Commercial Vehicle Control Center (CVCC) 
4.3.7.1 Ground Monitoring and Operation 


The capabilities for ground personnel to monitor, operate, and control the integrated space 
vehicle and subsystems shall be verified by analysis and test. A functional analysis shall be 
performed to determine functions required to execute mission operations and operational 
controls to hazards. A functional allocation analysis shall be performed to determine the 
functions the ground personnel can control to execute the mission tasks and operational controls 
to hazards. Test simulations shall be performed with the CVCC(s) and an emulated integrated 
space vehicle to show that all functions can be executed in the required phases and vehicle 
modes per the functional analysis. The verification shall be considered successful when tests 
show that under the planned communications coverage the ground personnel can monitor, 
operate, and control the functions allocated to them necessary to execute the mission, prevent a 
catastrophic event, and prevent an abort. [V.CTS.110] 


4.3.7.2 RESERVED 
4.3.7.3 CVCC/MCC-H Data Integration 


The capability of the CTS to exchange real-time mission support data between the CVCC and 
the NASA ISS MCC-H shall be verified by inspection and test. The inspection shall evaluate the 
Interface Control Document (ICD) or equivalent that captures the negotiated data types and 
interfaces between the CVCC and the NASA ISS MCC-H to provide real-time data. The test 
shall show that each data type and interface negotiated functions, as per the ICD or equivalent, 
support real-time mission operations. The test shall be an end-to-end test performed with the 
ground systems. The verification shall be considered successful when the inspection and test 
shows the CTS is capable of exchanging real-time mission support data between the CVCC and 
the NASA ISS MCC-H. [V.CTS.112] 


4.3.8 Spacecraft 
4.3.8.1 Communications 
4.3.8.1.1 Voice Communication with Crew 


The CTS's provision of single failure tolerant two-way voice communication between CVCC(s) 
and the spacecraft shall be verified by demonstration, analysis, and inspection. An inspection 
shall be performed on the CVCC and spacecraft drawings and subsystem level test data to 
determine failure tolerance. An integrated demonstration shall be performed between the CVCC 
and the two-way voice communications system on the spacecraft. Analysis shall be used to 
address limitations on demonstration as well as to assess any adjustments due to constraints 
levied within the issued operational license. The verification shall be considered successful 
when inspection of drawings and subsystem test data are complete to show failure tolerance, and 
demonstration with analysis shows voice communications between the CVCC and the spacecraft 
can be provided from pre-launch through landing and during aborts. [V.CTS.113] 
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4.3.8.1.2 Communications Coverage 


The CTS's provision of 90% communications coverage during the powered ascent flight phase 
and 65% during the entry flight phase shall be verified by analysis and inspection. The 
inspection shall consist of approved operational license for each of the radio frequency link(s) 
that provide the two-way voice and telemetry. The analysis shall derive an expected aggregate 
interference degradation based on an expected RF environment. Communication coverage is 
defined as successful link availability for nominal ascent and entry trajectories (to supported 
sites), and a communication link is established. Structural blockage, vehicle attitude, antenna 
pointing direction, and trajectory shall be factored into the analysis. The verification shall be 
considered successful when the analysis meets the criteria specified in CCT-STD-1140 Section 
7.1.11.1 and shows that the spacecraft has 90% communications coverage (two-way voice and 
telemetry) during the ascent flight phase and 65% coverage during the entry flight phase in the 
expected RF environment and under the conditions granted in link radio licenses. [V.CTS.114] 


4.3.8.1.3 RESERVED 
4.3.8.1.4 Private Audio 


The CTS's two-way private voice communication shall be verified by demonstration. The 
demonstration shall be between a flight representative vehicle and the designated mission control 
center flight control team positions. The verification shall be considered successful when the 
demonstration shows that audio transmitted between the vehicle and the mission control center 
can only be heard on orbit and at the designated flight control team positions. [V.CTS.116] 


4.3.8.1.5 Integrated Voice Communications during ISS Proximity and Docked Operations 


The CTS's provision of simultaneous two-way voice communications between the ISS, CTS 
spacecraft, CVCC, and ISS Mission Control Center shall be verified by analysis and test. The 
analysis shall include simulation of the end-to-end voice communications design, free flight to 
and from ISS operational scenarios, docked operational scenarios, and conditions that could 
impact the communications effectiveness. The testing shall include end-to-end testing, including 
interfaces, and shall be performed with flight representative systems. The verification shall be 
considered successful when the analysis, supported by the testing, shows that the CTS will 
support two-way voice communications between ISS, CTS spacecraft, CVCC, and ISS Mission 
Control Center for all planned docked operations and free flight operations when the CTS 
spacecraft is within 10 km of the ISS. [V.CTS.117] 


4.3.8.1.6 RESERVED 
4.3.8.1.7_ Command and Telemetry Communications 


The CTS's provision of single failure tolerant command and telemetry communication between 
CVCC(s) and the spacecraft shall be verified by demonstration, analysis, and inspection. An 
inspection shall be performed on the CVCC and spacecraft drawings and subsystem level test 
data to determine failure tolerance. An integrated demonstration shall be performed between the 
CVCC and the command and telemetry communication system on the spacecraft. Analysis shall 
be used to address limitations on demonstration as well as to assess any adjustments due to 
constraints levied within the issued operational license. Verification of this requirement shall be 
considered successful when inspection of drawings and subsystem test data are complete to show 
failure tolerance and demonstration with analysis shows command and telemetry communication 
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between the CVCC and the spacecraft can be provided from pre-launch through landing and 
during aborts. [V.CTS.351] 


4.3.8.1.8 Communication 


The communications performance and compatibility with existing users of the same spectrum 
shall be verified through analysis. The analysis shall assess verification closures of allocated 
performance requirements and spectrum standards. The verification shall be considered 
successful when the analysis shows that allocated performance and compatibility with other 
spectrum users' criteria shown in the "Communications" and "Spectrum Utilization" sections of 
CCT-STD-1140 have been met. [V.CTS.380] 


4.3.8.2 Command Link Security 
4.3.8.2.1_ Advanced Encryption Standards 


The hardware and software for encryption and decryption module requirements for all launch 
vehicle and spacecraft commanding, excluding FTS commanding, shall be verified by inspection 
and demonstration. The inspection shall review the implementation methods and laboratory test 
results, along with NIST validation certificates. Specific use of the algorithm shall be 
demonstrated on the hardware employed for the CTS. The verification shall be considered 
successful when inspection and demonstration show that the Federal Information Processing 
Standard (FIPS) Publication 197, Advance Encryption Standard (AES) has been implemented in 
accordance with FIPS Pub 140-2, FIPS Pub 46-3, and ANSI 9.52 certification, for a security 
Level 2. A NIST-validated Laboratory (e.g., INFOGARD) is responsible for performing the 
verification. [V.CTS.122] 


4.3.8.2.2 Requirements for Cryptographic Modules 


The performance of cryptographic operations using devices have met FIPS Publication 140-2 
shall be verified by inspection and demonstration. The inspection shall review the security level 
2 allocated verification closures and laboratory test results. Role-based authentication shall be 
demonstrated on the system employed for the CTS. The verification shall be considered 
successful when the inspection and demonstration show that FIPS Publication 140-2, 
certification for a security Level 2 has been met. A NIST validated Laboratory (e.g., 
INFOGARD) is responsible for performing the verification. [V.CTS.123] 


4.3.8.2.3 Cryptographic Key Management 


The CTS management of cryptographic keys shall be verified by inspection. The inspection 
shall review the allocated verification closures of protection requirements and the distribution 
and storage of cryptographic and cryptographic related data. The verification shall be considered 
successful when the inspection shows that the National Institute of Standards and Technology 
(NIST) SP 800-57, Recommendation for Key Management-Part | has been satisfied. 
[V.CTS.124] 


4.3.8.3 Onorbit Maintenance 
4.3.8.3.1 Preventative Maintenance 


The requirement of the spacecraft to need no more than 2 crew hours of IVA for preventative 
maintenance every 30 days during ISS docked operations shall be verified by analysis. The 
analysis shall include the review of the as-built spacecraft design and the planned maintenance 
activities and procedures. The verification shall be considered successful when the analysis 


Commercial Crew Program 
International Space Station Program Page 143 of 295 


ISS Crew Transportation and CCT-REQ-1130 
Services Requirements Document Revision: E-1 


shows the planned IVA preventive maintenance can be accomplished in less than 2 crew hours 
every 30 days during ISS docked operations. [V.CTS.126] 


4.3.8.3.2 Maintenance Tools 


The CTS's provision for a set of in-flight tools shall be verified by inspection. The verification 
shall be considered successful when inspections shows that all the unique tools required for 
onorbit maintenance and reconfiguration have been provided. [V.CTS.127] 


4.3.8.4 Manual Control 
4.3.8.4.1 Manual Control of Vehicle Flight Path 


Crew manual control of the vehicle flight path, attitude, and attitude rates shall be verified by 
analysis and test. Analysis shall be performed to show that manual control capability for vehicle 
flight path, attitude, and attitude rates is controllable and stable for a dispersed set of inputs that 
includes hand controller inputs. The testing shall use a GN&C simulation integrated with a pilot- 
in-the-loop test facility, with flight-representative hand controllers, displays, and out-the-window 
scenes. Testing shall use these facilities to capture and analyze manual control performance of 
the vehicle on a set of scenarios representative of the manual control capabilities available. The 
verification shall be considered successful when analysis and test results show that manual 
control capability is provided without violating structural, thermal, performance margins, and the 
budgeted timeline for these tasks for all relevant flight phases. 


See CCT-STD-1140, "Flight Mechanics and GN&C Technical Assessment" section for technical 
verification expectations pertinent to flight mechanics. [V.CTS.128] 


4.3.8.4.2 Manual Piloting for Docking 


Crew manual piloting to accomplish docking shall be verified by analysis and test. An analysis 
shall be conducted to identify the crew tasks required to execute manual piloting for docking 
within the approach ellipse. Analysis shall be performed to show that manual piloting capability 
for docking tasks is controllable and stable for a dispersed set of inputs that includes hand 
controller inputs. The testing shall use a GN&C simulation integrated with a pilot-in-the-loop 
test facility, with flight-representative hand controllers, displays, flight data, avionics, software, 
and out-the-window scenes. Testing shall use these facilities to capture and analyze manual 
piloting performance of the vehicle for docking and shall include system and environment 
dispersions. Testing shall include all crew tasks necessary to accomplish manual piloting for 
docking including tasks necessary to control catastrophic hazards. The verification shall be 
considered successful when analysis and test results show that manual piloting capability is 
provided without violating structural, thermal, performance margins, and the budgeted timeline 
for these tasks for docking. 


See CCT-STD-1140, "Flight Mechanics and GN&C Technical Assessment" section for technical 
verification expectations pertinent to flight mechanics. [V.CTS.385] 


4.3.8.4.3 Handling Qualities 


Handling qualities shall be verified by analysis and test. Selected manual control scenarios will 
be defined via review of potential manual control scenarios and associated manual control modes 
(as identified in 3.8.4.1 and 3.8.4.2, 3.8.5.1.1, and 3.5.2.1). Analysis shall be performed to select 
the manual control scenarios selected for testing and required handling qualities ratings. Manual 
control scenarios shall be selected based on the following considerations; 1) manual control 
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scenarios necessary to meet 3.8.4.2 Manual Piloting for Docking, 2) catastrophic hazard controls 
that utilize manual control capabilities as part of their mitigation strategy, and 3) manual control 
scenarios that are uniquely different or more complex than Manual Piloting for Docking. For 
each selected scenario, a list of handling quality related tasks will be generated as part of a task 
analysis. A handling quality related task is defined as the manual control capability that is being 
rated with the Cooper-Harper Rating Scale. Each task within a scenario is rated separately and 
must meet Level | (handling quality ratings of 1, 2, or 3). A test shall be conducted for each 
selected scenario with at least five test subjects trained as pilots for the particular spacecraft 
being evaluated and trained in Cooper-Harper evaluations. Test subjects shall perform the 
manual control scenarios in flight configuration in a flight representative cockpit and provide 
Cooper-Harper evaluations for each task in the scenario. The verification shall be considered 
successful when the analysis and test show that for each task associated with each of the selected 
manual control scenarios where manual control is the primary control method or where the 
automated control system is non-operational, at least 60% of the ratings are Level | (handling 
quality ratings of 1, 2 or 3), while up to 40% may exceed Level | with a Level 2 rating (handling 
quality rating of 4, 5, or 6). For any ratings of 4, 5, or 6 to be considered successful, a consensus 
must be reached by all of the participants indicating that handling qualities are acceptable. For all 
other scenarios, at least 80% of the ratings must be Level 1 or 2 (HQR of 1, 2, 3, 4, 5 or 6), while 
up to 20% may exceed Level 2 with a Level 3 rating (HQR of 7, 8 or 9). For any ratings of 7, 8 
or 9 to be considered successful, a consensus must be reached by all of the participants indicating 
that handling qualities are acceptable. [V.CTS.129] 


4.3.8.4.4 Windows for Crew Tasks 


Window fields-of-view for expected crew viewing tasks shall be verified by analysis and 
demonstration. The analysis shall identify nominal and off-nominal tasks requiring visual 
information from outside of the spacecraft and include simulations of operational scenarios 
depicting the interior and exterior of the vehicle. The analysis shall provide a graphical depiction 
of the lines of sight through the fields-of-view of the windows with respect to their installation in 
the system. The demonstration shall evaluate the adequacy of the positioning of, and fields of 
view provided by, the windows for crew tasks in a flight representative vehicle with the crew in 
the flight configuration and to ensure there are no obstructions to viewing within the fields of 
view. The verification shall be considered successful when the analysis shows that the windows 
provide the unobstructed fields-of-view necessary to support expected crew viewing tasks and 
the demonstration shows that the viewing tasks can be accomplished. [V.CTS.177] 


4.3.8.5 Crew Interface 
4.3.8.5.1 General Crew Interfaces 
4.3.8.5.1.1 Crew Control of Vehicle 


The capabilities for the crew to monitor, operate, and control the integrated space vehicle and 
subsystems shall be verified by analysis and test. A functional analysis shall be performed to 
determine functions required to execute mission operations, capabilities required for operational 
control of catastrophic hazards, and capabilities required for preventing an abort. A functional 
allocation shall be performed to determine the functions the crew can control to execute the 
mission tasks, operationally control catastrophic hazards, and prevent an abort. A test shall be 
performed with crew in flight configuration in a flight-representative vehicle to show that all 
functions can be executed in the required phases and vehicle modes per the functional analysis. 
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The verification shall be considered successful when test shows that the crew can monitor, 
operate, and control the functions allocated to them to fully execute the mission, prevent a 
catastrophic event, and prevent an abort. [V.CTS.130] 


4.3.8.5.1.2 Tolerate Inadvertent Action 


The CTS's ability to tolerate an inadvertent operator action without causing a catastrophic event 
shall be verified by analysis and demonstration. A task analysis shall be performed to identify 
human interactions required for operations and control of the system, including responses to 
system failures. A human error analysis (HEA) shall be performed, as defined in Section 4.7 of 
CCT-PLN-1120. The HEA shall define the source of human errors derived from these tasks and 
the design and operational controls to mitigate or limit the effects. A system performance 
analysis shall be performed to determine the operational impact of the inadvertent action. A 
demonstration of human system interaction tasks shall be performed with simulated errors 
utilizing flight representative hardware and software in the flight configuration. The 
verification shall be considered successful when the performance analysis and demonstration 
shows that the design can tolerate the inadvertent operator action without causing a catastrophic 
event. [V.CTS.131] 


4.3.8.5.1.3 Controls for Human Error 


The CTS implementation of human error controls shall be verified by analysis, inspection, and 
demonstration. A task analysis shall be performed to identify human interactions required for 
the maintenance, operations and control of the system. A human error analysis (HEA) shall be 
performed, as defined in Section 4.7 of CCT-PLN-1120. The HEA shall define the source of 
human errors derived from the tasks and the design and operational controls to mitigate or limit 
the effects. An inspection of drawings and hardware shall confirm maintenance and operational 
controls for human error have been incorporated. A demonstration of human system interaction 
tasks shall be performed with simulated errors utilizing flight representative hardware and 
software. The verification shall be considered successful when the inspection shows that design 
and operational controls have been implemented for those sources of errors identified in the 
HEA, and the demonstration shows that the mitigation is effective at preventing the error or the 
system allows the human to detect and correct or recover from the errors. [V.CTS.132] 


4.3.8.5.1.4 Tolerate Inadvertent Action during Failure 


The CTS's ability to tolerate inadvertent operator action in the presence of any single system 
failure shall be verified by analysis and demonstration. A task analysis shall be performed to 
identify human interactions required for operations and control of the system, including 
responses to system failures. A human error analysis (HEA) shall be performed, as defined in 
Section 4.7 of CCT-PLN-1120. The HEA shall define the source of human errors derived from 
these tasks and the design and operational controls to mitigate or limit the effects in the presence 
of a single system failure. A system performance analysis shall be performed to determine the 
operational impact of the inadvertent action in the presence of a single system failure. A 
demonstration of human system interaction tasks shall be performed with simulated errors 
utilizing flight representative hardware and software in the flight configuration that represents 
the simulated system failure. The verification shall be considered successful when the 
performance analysis and demonstration shows that the design can tolerate the inadvertent 
operator action in the presence of a single system failure without causing a catastrophic event. 
[V.CTS.134] 
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4.3.8.5.1.5 Operable by Single Crewmember 


Spacecraft operability by a single crewmember shall be verified by analysis and demonstration. 
An operational task analysis shall be completed to ensure all accommodations for single crew 
operability have been considered in the design phase. A demonstration shall be performed with a 
single crewmember in flight configuration in a flight representative cockpit that verifies a single 
crewmember can accomplish all necessary tasks. The verification shall be considered successful 
when the demonstration and analysis show that the system is operable by any one crewmember 
for operations requiring crew control. [V.CTS.135] 


4.3.9 Spacecraft and Launch Vehicle Design Manufacturing Standards 
4.3.9.1 Materials and Processes 
4.3.9.1.1 Materials and Processes 


The application of NASA- STD-6016 or approved alternative standard to the CTS shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated CTS design and production elements have 
met NASA- STD-6016 or the approved alternative standard. [V.CTS.260] 


4.3.9.1.2 Cabin Materials Flammability 


The materials used in the spacecraft cabin shall be verified to meet the flammability 
requirements of NASA-STD-6016 in 30% oxygen at a pressure of 10.2 psia by inspection, test, 
and analysis. The inspection shall consist of comparing the materials used in the spacecraft 
cabin with the existing M&P database. Test and analysis shall be performed to verify 
compliance with the flammability requirements of NASA-STD-6016 where the material is not in 
the existing M&P database. The verification shall be considered successful when the inspection, 
test, and analysis show that all materials used in the spacecraft cabin meet the flammability 
requirements of NASA-STD-6016. [V.CTS.376] 


4.3.9.2 Flight and Ground Software 
4.3.9.2.1 Software Engineering Requirements 


The application of 7150.2A or approved alternative standard to the CTS shall be verified by 
inspection. The inspection shall review verification closure of allocations of the approved 
standard to design and production elements. The verification shall be considered successful 
when the inspection shows that allocated CTS design and production elements have met 7150.2A 
or the approved alternative standard. [V.CTS.262] 


4.3.9.3 Electrical and Avionics 
4.3.9.3.1 Use of Silver 
4.3.9.3.1.1 Electrically Deposited Silver 


The prohibited use of electrically deposited silver as plating on printed wiring boards and 
terminal boards shall be verified by inspection. The verification shall be considered successful 
when an inspection of the end item drawings show that electrically deposited silver is not used as 
plating on printed wiring boards and terminal boards. [V.CTS.266] 
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4.3.9.3.1.2 Silver Plating 


The prohibited use of electrically deposited silver as plating on bus bars and mechanical 
electrical contacts, such as connector pins and sockets shall be verified by inspection. The 
verification shall be considered successful when an inspection of the end item drawings show 
that electrically deposited silver is not used as plating on bus bars and mechanical electrical 
contacts, such as connector pins and sockets. [V.CTS.267] 


4.3.9.3.2 RESERVED 
4.3.9.3.3 Printed Wiring Boards 
4.3.9.3.3.1 Printed Board Design Standards 


The application of IPC-2221 and the associated technology performance specification under the 
IPC 2220 series per performance Class 3 or approved alternative standards to the CTS shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated CTS design and production elements have 
met IPC-2221 and the associated technology performance specification under the IPC 2220 
series per performance Class 3 or the approved alternative standards. [V.CTS.268] 


4.3.9.3.3.2 Qualification of Printed Boards Standard 


The application of IPC-6011 and the associated technology performance specification under the 
IPC-6010 series or approved alternative standards to the CTS shall be verified by inspection. 
The inspection shall review verification closure of allocations of the approved standard to design 
and production elements. The verification shall be considered successful when the inspection 
shows that allocated CTS design and production elements have met IPC-6011 and the associated 
technology performance specification under the IPC-6010 series or the approved alternative 
standards. [V.CTS.269] 


4.3.9.3.3.3 Conductor Size Standard 


The application of IPC-2152 or approved alternative standard to the CTS shall be verified by 
inspection. The inspection shall review verification closure of allocations of the approved 
standard to design and production elements. The verification shall be considered successful 
when the inspection shows that allocated CTS design and production elements have met IPC- 
2152 or the approved alternative standard. [V.CTS.270] 


4.3.9.3.4 Printed Wiring Assemblies 
4.3.9.3.4.1 Printed Wiring Assemblies 


Electrical circuitry design and fabrication to prevent the production of unwanted current paths 
caused by debris or foreign materials floating in the spacecraft shall be verified by inspection, 
analysis, and test. [V.CTS.271] 


4.3.9.3.5 Fiber Optics 
4.3.9.3.5.1 RESERVED 
4.3.9.3.5.2 Fiber Optic Connection Standard 


The application of NASA-STD-8739.5 or approved alternative standard to the CTS shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
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approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated CTS design and production elements have 
met NASA-STD-8739.5 or the approved alternative standard. [V.CTS.273] 


4.3.9.3.6 Staking/Conformal Coating 
4.3.9.3.6.1 Staking/Conformal Coating 


The application of NASA-STD- 8739.1 or approved alternative standard to the CTS shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated CTS design and production elements have 
met NASA-STD- 8739.1 or the approved alternative standard. [V.CTS.274] 


4.3.9.3.7 Electrical Soldering 
4.3.9.3.7.1 Soldering Process and Controls Standard 


The application of IPC J-STD-001ES or approved alternative standard to the integrated space 
vehicle shall be verified by inspection. The inspection shall review verification closure of 
allocations of the approved standard to design and production elements. The verification shall be 
considered successful when the inspection shows that allocated integrated space vehicle design 
and production elements have met IPC J-STD-O01ES or the approved alternative standard. 
[V.CTS.275] 


4.3.9.3.7.2 RESERVED 
4.3.9.3.7.3 Soldering Performance Standard 


The application of GEIA-STD-0005-1 or approved alternative standard to the CTS shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated CTS design and production elements have 
met GEIA-STD-0005-1 or the approved alternative standard. [V.CTS.277] 


4.3.9.3.7.4 Mitigation of Tin Whiskers 


The application of GEIA-STD-0005-2 or approved alternative standard to the CTS shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated CTS design and production elements have 
met GEJA-STD-0005-2 or the approved alternative standard. [V.CTS.278] 


4.3.9.3.8 Electrical Crimping 
4.3.9.3.8.1 Wiring, Cables, Harnesses and Crimping 


The application of NASA- STD-8739.4 or approved alternative standard and SAE-AS-7928 to 
the CTS shall be verified by inspection. The inspection shall review verification closure of 
allocations of the approved standard to design and production elements. The verification shall be 
considered successful when the inspection shows that allocated CTS design and production 
elements have met NASA- STD-8739.4 or approved alternative standard and SAE-AS-7928. 
[V.CTS.279] 
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4.3.9.3.9 Electrical Wire Wrapped Connections 
4.3.9.3.9.1 Electrical Wire Wrapped Connections 


An inspection of the end item drawings and process sampling of hardware shall verify that wire 
wrapping has not been used. [V.CTS.280] 


4.3.9.3.10 Electrical Bonding 
4.3.9.3.10.1 Electrical Bonding 


The application of NASA-STD-4003 or approved alternative standard to the integrated space 
vehicle shall be verified by inspection. The inspection shall review verification closure of 
allocations of the approved standard to design and production elements. The verification shall be 
considered successful when the inspection shows that allocated integrated space vehicle design 
and production elements have met NASA-STD-4003 or the approved alternative standard. 
[V.CTS.281] 


4.3.9.3.11 Batteries 
4.3.9.3.11.1 Batteries 


The application of JSC 20793 or approved alternative standard to the integrated space vehicle 
shall be verified by inspection. The inspection shall review verification closure of allocations of 
the approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated integrated space vehicle design and 
production elements have met JSC 20793 or the approved alternative standard. [V.CTS.282] 


4.3.9.3.12 Other Processes 
4.3.9.3.12.1 RESERVED 
4.3.9.3.12.2 Component Mounting Guidelines 


The application of IPC-CM-770E or approved alternative standard to the CTS shall be verified 
by inspection. The inspection shall review verification closure of allocations of the approved 
standard to design and production elements. The verification shall be considered successful 
when the inspection shows that allocated CTS design and production elements have met IPC- 
CM-770E or the approved alternative standard. [V.CTS.284] 


4.3.9.3.13 Integrated Space Vehicle Electrostatic Charge Control 
4.3.9.3.13.1 LEO Charging Design Standard 


The application of NASA-STD- 4005 or approved alternative standard to the spacecraft shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated spacecraft design and productions elements 
have met NASA-STD- 4005 or the approved alternative standard. [V.CTS.285] 


4.3.9.3.13.2 Electrostatic Discharge Control Program 


The application of ANSI/ESD $20.20 or approved alternative standard to the CTS shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
approved standard to design and production elements. The verification shall be considered 
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successful when the inspection shows that allocated CTS design and production elements have 
met ANSI/ESD S20.20 or the approved alternative standard. [V.CTS.286] 


4.3.9.3.13.3 Electrostatic Design Thresholds 


The application of IEC 61000-4-2 or approved alternative standard to the CTS shall be verified 
by inspection. The inspection shall review verification closure of allocations of the approved 
standard to design and production elements. The verification shall be considered successful 
when the inspection shows that allocated CTS design and production elements have met IEC 
61000-4-2 or the approved alternative standard. [V.CTS.371] 


4.3.9.3.14 Electromagnetic Interference Control 
4.3.9.3.14.1 Electromagnetic Interference Control 


The application of MIL-STD-461 or approved alternative standard to the integrated space vehicle 
shall be verified by inspection. The inspection shall review verification closure of allocations of 
the approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated integrated space vehicle design and 
production elements have met MIL-STD-461 or the approved alternative standard. [V.CTS.287] 


4.3.9.3.15 Electromagnetic Environmental Effects 
4.3.9.3.15.1 Electromagnetic Environmental Effects 


The application of MIL-STD-464 or approved alternative standard to the integrated space vehicle 
shall be verified by inspection. The inspection shall review verification closure of allocations of 
the approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated integrated space vehicle design and 
production elements have met MIL-STD-464 or the approved alternative standard. [V.CTS.288] 


4.3.9.3.16 Custom Electromagnetic Devices 
4.3.9.3.16.1 Custom Electromagnetic Devices 


The application of MIL-STD-981 or approved alternative standard to the integrated space vehicle 
shall be verified by inspection. The inspection shall review verification closure of allocations of 
the approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated integrated space vehicle design and 
production elements have met MIL-STD-981 or the approved alternative standard. [V.CTS.289] 


4.3.9.3.17 Lightning 
4.3.9.3.17.1 Lightning Protection Design 


The application of SAE ARP 5412A, FAA AC 20-136B, SAE ARP 5414A and SAE ARP 5577 
or approved alternative standards to the integrated space vehicle shall be verified by inspection. 
The inspection shall review verification closure of allocations of the approved standard to design 
and production elements. The verification shall be considered successful when the inspection 
shows that allocated integrated space vehicle design and production elements have met SAE 
ARP 5412A, FAA AC 20-136A, SAE ARP 5414A and SAE ARP 5577 or the approved 
alternative standards. [V.CTS.290] 
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4.3.9.4 Aerodynamic Deceleration Systems 
4.3.9.4.1 Trailing Deployable Aerodynamic Decelerator 
4.3.9.4.1.1 Trailing Deployable Aerodynamic Decelerator Design 


The application of JSC 65985 or approved alternative standard to the integrated space vehicle 
shall be verified by inspection. The inspection shall review verification closure of allocations of 
the approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated integrated space vehicle design and 
production elements have met JSC 65985 or the approved alternative standard. [V.CTS.291] 


4.3.9.5 Mechanisms 
4.3.9.5.1 Mechanism Design 


The application of NASA-STD-5017 (excluding sections 4.7 and 4.8.9) or approved alternative 
standard to the integrated space vehicle shall be verified by inspection. The inspection shall 
review verification closure of allocations of the approved standard to design and production 
elements. The verification shall be considered successful when the inspection shows that 
allocated integrated space vehicle design and production elements have met NASA-STD-5017 
(excluding sections 4.7 and 4.8.9) or the approved alternative standard. [V.CTS.292] 


4.3.9.6 Thermal Protection System (TPS) 
4.3.9.6.1 Thermal Protection System (TPS) Design 


The application of JSC 65827 or approved alternative standard to the spacecraft shall be verified 
by inspection. The inspection shall review verification closure of allocations of the approved 
standard to design and production elements. The verification shall be considered successful 
when the inspection shows that allocated spacecraft design and production elements have met 
JSC 65827 or the approved alternative standard. [V.CTS.293] 


4.3.9.6.2 TPS Structural Design 


The application of standards listed in section 3.9.8 or approved alternative standards to the 
integrated space vehicle TPS shall be verified by inspection. The inspection shall review 
verification closure of allocations of the approved standard to design and production elements. 
The verification shall be considered successful when the inspection shows that allocated 
integrated space vehicle design and production elements have met the standards listed in section 
3.9.8 or the approved alternative standards. [V.CTS.372] 


4.3.9.7 Pyrotechnics 
4.3.9.7.1_ Pyrotechnics 


The application of JSC 62809 or approved alternative standard to the CTS shall be verified by 
inspection. The inspection shall review verification closure of allocations of the approved 
standard to design and production elements. The verification shall be considered successful 
when the inspection shows that allocated CTS design and production elements have met JSC 
62809 or the approved alternative standard. [V.CTS.294] 


4.3.9.8 Structures 
4.3.9.8.1 Structural Design and Factors of Safety 
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4.3.9.8.1.1 Structural Design Requirements 


The application of JSC 65828 or approved alternative standard to the integrated space vehicle 
(excluding glass and ceramic windows) shall be verified by inspection. The inspection shall 
review verification closure of allocations of the approved standard to design and production 
elements. The verification shall be considered successful when the inspection shows that 
allocated integrated space vehicle design and production elements (excluding glass and ceramic 
windows) have met JSC 65828 or the approved alternative standard. [V.CTS.295] 


4.3.9.8.1.2 Windows Design 


The application of NASA-STD-5018 or approved alternative standard to the integrated space 
vehicle shall be verified by inspection. The inspection shall review verification closure of 
allocations of the approved standard to design and production elements. The verification shall be 
considered successful when the inspection shows that allocated integrated space vehicle design 
and production elements have met NASA-STD-5018 or the approved alternative standard. 
[V.CTS.296] 


4.3.9.8.2 Loads and Structural Dynamics 
4.3.9.8.2.1 Loads and Structural Dynamics 


The application of JSC 65829 or approved alternative standard to the integrated space vehicle 
shall be verified by inspection. The inspection shall review verification closure of allocations of 
the approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated integrated space vehicle design and 
production elements have met JSC 65829 or the approved alternative standard. [V.CTS.297] 


4.3.9.8.3 Fasteners 


The application of NASA-STD-5020 or approved alternative standard to the integrated space 
vehicle shall be verified by inspection. The inspection shall review verification closure of 
allocations of the approved standard to design and production elements. The verification shall be 
considered successful when the inspection shows that allocated integrated space vehicle design 
and production elements have met NASA-STD-5020 or the approved alternative standard. 
[V.CTS.298] 


4.3.9.9 Fluids, Propellants, Explosives, and Oxygen Systems 
4.3.9.9.1 Flexible Lines and Flow-Induced Vibration 


The design of the CTS metal bellows and flexhoses to prevent flow-induced vibration (FIV) in 
the operating flow range +/-10% shall be verified by analysis. The analysis shall meet the intent 
of MSFC-DWG-20M02540. The verification shall be considered successful when the analysis 
shows no FIV exists. 


If FIV is predicted by the analysis and no alternative design solutions exist to eliminate FIV, then 
the design shall be verified by performing a flow test. The test shall meet the intent of MSFC- 
SPEC-626. The verification shall be considered successful when the test shows the part life is 
four times the operational life with no failure. 


For bellows and flexhoses used in ground systems and ground equipment, whose failure does not 
pose a critical hazard and where the analysis shows FIV to exist over the operating flow range 
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+/-10 %, the design shall be verified by performing a fatigue life assessment analysis. The 
verification shall be considered successful when the analysis shows a theoretical infinite life. 


The design of CTS metal bellows and flexhoses with atypical flow environments shall be 
verified by an alternative analysis and test. The alternative analysis approach shall be performed 
to determine if any FIV occurs over the operating flow range +/-10%. A test shall be performed 
to show the alternative analysis approach is valid. The verification of the alternative analysis 
approach shall be considered successful when the alternative analysis is shown to be valid by the 
test program. [V.CTS.303] 


4.3.9.10 Propulsion Systems 
4.3.9.10.1 Strength and Life Requirements for Propulsion Systems 


The application of NASA-STD-5012 or approved alternative standard to the integrated space 
vehicle shall be verified by inspection. The inspection shall review verification closure of 
allocations of the approved standard to design and production elements. The verification shall be 
considered successful when the inspection shows that allocated integrated space vehicle design 
and production elements have met NASA-STD-5012 or the approved alternative standard. 
[V.CTS.304] 


4.3.9.11 Fracture Control 
4.3.9.11.1 Fracture Control 


The application of NASA-STD-5019 or approved alternative standard to the integrated space 
vehicle shall be verified by inspection. The inspection shall review verification closure of 
allocations of the approved standard to design and production elements. The verification shall be 
considered successful when the inspection shows that allocated integrated space vehicle design 
and production elements have met NASA-STD-5019 or the approved alternative standard. 
[V.CTS.307] 


4.3.9.12 Parts 
4.3.9.12.1 Parts 


The application of SMC-S-010 or approved alternative standard to the CTS shall be verified by 
inspection. The inspection shall review verification closure of allocations of the approved 
standard to design and production elements. The verification shall be considered successful 
when the inspection shows that allocated CTS design and production elements have met SMC-S- 
010 or the approved alternative standard. [V.CTS.319] 


4.3.9.13 Testing 
4.3.9.13.1 Ground Testing 


The application of SMC-S- 016 or approved alternative standard to the integrated space vehicle 
shall be verified by inspection. The inspection shall review verification closure of allocations of 
the approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated integrated space vehicle design and 
production elements have met SMC-S- 016 or the approved alternative standard. [V.CTS.315] 
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4.3.9.14 Models and Simulations 
4.3.9.14.1 Models and Simulations 


The application of sections 4.1.1, 4.1.2, 4.7 and 4.8 of NASA-STD-7009 to the CTS shall be 
verified by inspection. The inspection shall review verification closure of allocations of the 
approved standard to design and production elements. The verification shall be considered 
successful when the inspection shows that allocated CTS design and production elements have 
met sections 4.1.1, 4.1.2, 4.7 and 4.8 of NASA-STD-7009 or the approved alternative standard. 
[V.CTS.381] 


4.3.10 Human Health, Medical and Performance 
4.3.10.1 Human Interface Design Standards 


The CTS's ability to meet the intent of the human integration design requirements shall be 
verified by inspection. The inspection shall consist of an inspection of records from test, 
analyses, and demonstrations of Appendix Q design requirements. The verification shall be 
considered successful when the inspection shows that verification of requirements or their 
accepted alternatives in Appendix Q are complete. [V.CTS.343] 


4.3.10.2Crew Acceleration and Vibration Limitations 
4.3.10.2.1 Sustained Translational Acceleration Limits 


The crew exposure to sustained linear acceleration shall be verified by analysis. The analysis 
shall use a validated simulation to identify and assess bounding acceleration cases including 
GN&C, vehicle, and environmental dispersions. The verification shall be considered successful 
when the analyses indicates that simulated linear acceleration exposures of 0.5 seconds or more 
are no greater than the limits depicted in Appendix H, Figures H-1, H-2, H-3, H-4, and H-S. 
[V.CTS.216] 


4.3.10.2.2 Rotational Velocity Limits 


The crew exposure to rotational velocity shall be verified by analysis. The analysis shall use a 
validated simulation to identify and assess bounding acceleration cases including GN&C, 
vehicle, and environmental dispersions. The verification shall be considered successful when the 
analysis indicates that rotational velocities are no greater than the limits in those depicted in 
Figure 3.10.1.2-1. [V.CTS.217] 


4.3.10.2.3 Sustained Cross-Coupled Rotational Acceleration 


The crew exposure to sustained cross-coupled rotational acceleration shall be verified by 
analysis. The analysis shall use a validated simulation to identify and assess bounding 
acceleration cases including GN&C, vehicle, and environmental dispersions. The verification 
shall be considered successful when the analysis indicates that any product of two unique body 
attitude rates in yaw, pitch, or roll is no greater than 2 rad/s2. [V.CTS.218] 


4.3.10.2.4 RESERVED 
4.3.10.2.5 Acceleration Rate of Change 


The crew exposure to jerk during sustained events shall be verified by analysis. The analysis 
shall use a validated simulation to identify and assess bounding acceleration cases including 
GN&C, vehicle, and environmental dispersions. The verification shall be considered successful 
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when the analysis indicates that the simulated jerk is no greater than 500 g/s during any non- 
impact phase of flight. [V.CTS.220] 


4.3.10.2.6 Health Limits for Vibration during Dynamic Phases of Flight 


The dynamic phases of flight vibration exposure health limit shall be verified by analysis. The 
analysis shall consist of a simulation of the vibration levels at the crew seat (couch), assuming 
that the couch is a relatively rigid structure. The analysis shall consider all possible sources of 
vibration during each phase of flight. The weighted acceleration shall be calculated in 
accordance with ISO 2631-1:1997 using the frequency weighting Wd for the X and Y directions, 
Wk for the Z direction, and a multiplying factor k=1.4 in the X and Y directions and k=1 in the Z 
direction (ISO 2631-1:1997, Table 3 and Section 7.2). The verification shall be successful when 
for each phase of flight the predicted levels are below the requirements for the specified 
durations. [V.CTS.221] 


4.3.10.3. Dynamic Flight Occupant Protection 
4.3.10.3.1 Brinkley Dynamic Response Model 


The crew exposure to impact acceleration shall be verified by analysis and test. The analysis 
shall be used to determine the dynamic conditions during abort and landing, in which the crew 
are most-susceptible to injury. Analysis shall determine the vehicle acceleration conditions for 
the at-risk abort and landing scenarios. Tests shall provide transient acceleration data as 
measured at the seat occupant for the identified scenarios and conditions. Additional analysis 
shall calculate the injury risk criterion, B, for all Brinkley criteria based on test data for all 
identified scenarios. Test and analysis shall also provide evidence that relevant criteria are met 
that validate the use of the Brinkley Dynamic Response model limits shown in Table 4.3.10.3.1- 
1 per NASA TM-2013-217380. Tests shall also be performed to show that a flight representative 
system prevents injury to the occupant(s) utilizing representative vehicle systems and 
anthropomorphic test dummies (ATD). Reference Table 4.3.10.3.1-2 and NASA TM-2013- 
217380) for relevant Injury Assessment Reference Values (IARV) Limits. The verification shall 
be considered successful when the analyses and tests indicate that the beta index for all Brinkley 
criteria is 1.0 or less during each scenario and the design meets the limits shown in Table 
4.3.10.3.1-2 and NASA TM-2013-217380. [V.CTS.224] 


Commercial Crew Program 
International Space Station Program Page 156 of 295 


ISS Crew Transportation and 
Services Requirements Document 


CCT-REQ-1130 
Revision: E-1 


Table 4.3.10.3.1-1: Dynamic Response Limits 


DR Level x Y Z 
Eyeballs out | Eyeballs in ae ae Eyeballs up pan 
DRx < 0 DRx > 0 DRy <0 DRy > 0 DR; < 0 DR; > 0 
Low 
{Seeonditioned) -28 35 -11.3 11.3 -11.5 13.0 
Low 
(Non- -28 35 -15 15 -13.4 15.2 
Deconditioned)® 
saad 35 40 15 15 14.1 15.4 
(Deconditioned) j ; 
Medium 
(Non- -35 40 -20 20 -16.5 18.0 
Deconditioned)® 
High 
éDecondiioneds -46 46 -22.5 22.50 -17.5 19.5 
High 
(Non- -46 46 -30 30 -20.4 22.8 
Deconditioned)® 
The table values assume lateral supports are used (limiting side body movement). 
@ Use for healthy, non-deconditioned crew (e.g., launch abort cases) 
Table 4.3.10.3.1-2 Injury Assessment Reference Values (IARV) Limits 
ATD Metric ATD Size! Non-Deconditioned Deconditioned 
Nominal | Off-Nominal | Nominal | Off-Nominal 
HIC 15 5 Female 375 a25 375 a20 
95" Male 325 450 a25 450 
Head Rotational 5" Female 2,500 4,200 2,500 4,200 
Acceleration [rad/sec7] 95" Male 2,100 3,600 2,100 3,600 
Nij 5 Female 0.5 0.5 0.4 0.4 
95'" Male 0.5 0.5 0.4 0.4 
Peak Neck Axial Tension 5" Female 890 — 1,840 765 — 1,580 
Force [N]* 95" Male 2,000 — 3,390 1,720 — 2,910 
Peak Neck Axial 5" Female 890 — 2,310 765 — 1,990 
Compression Force [N | 95" Male 2,000 — 4,360 1,720 — 3,750 
Flail 5 Female Pass 
95" Male Pass 
Peak Lumbar Axial 5‘ Female 3,500 4,200 3,000 3,600 
Compression [N]* 95" Male 6,600 7,800 5,700 6,700 


'The following ATDs shall be used to evaluate the metrics in Table 4.3.10.3.1-2: 


5" percentile female automotive Hybrid III 
95" percentile male automotive Hybrid III 


Values in table are evaluated at varying time durations as specified in NASA TM-2013-217380. 
3Required only if amplification rule is not met by the design, as specified in NASA TM-2013-217380. Requires the use of a 
straight spine modification to the 95" percentile Male ATD 
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4.3.10.3.2 Limitation of Crew Injury 


The prevention of injury to crewmembers during dynamic phases of flight shall be verified by 
inspection, test, and analysis. Analysis shall identify applicable landing conditions and, using 
models, assess injury risk during dynamic phases of flight. Inspection shall be a review of the 
design, including hazard analysis and crew survival analysis results, drawings, graphical models, 
and/or physical mockups, to ensure that load paths are not concentrated, that restraints prevent 
limb flail, and that a survivable volume is preserved without structural impingement on crew 
during certified load cases, nominal and off-nominal. Tests shall also be performed to show that 
a flight representative system prevents injury to the occupant(s) utilizing representative vehicle 
systems and ATDs. The verification shall be considered successful when test, inspection and 
analyses indicate that the system prevents injury to crewmembers due to blunt force trauma, 
point loads, flail, and injurious forces to the body including the head and neck during dynamic 
phases of flight. [V.CTS.225] 


4.3.10.3.3 RESERVED 
4.3.10.4 Crew Interface Requirements 
4.3.10.4.1 Crew Interface Usability 


Crew satisfaction with spacecraft interfaces shall be verified by analysis and test. A task 
analysis shall be performed to identify human activities required for nominal and off-nominal 
operation in the applicable mission phases and environments. The test shall consist of a usability 
evaluation based on standard best practices (e.g., Jakob Nielsen's "Usability Engineering,” 1993). 
A minimum of 20 participants shall perform onboard tasks, identified through task analysis, in a 
flight representative vehicle. At the conclusion of the usability test, and prior to any debrief or 
administering of post-evaluation questionnaires, the participants shall complete the System 
Usability Scale (SUS) (Brooke, 1996) found in Appendix L, Figure L.3-1. The overall system 
usability shall be calculated as the scale position minus | for questions 1, 3, 5, 7, and 9, and 5 
minus the scale position for questions, 2, 4, 6, 8, and 10. The overall satisfaction score shall be 
obtained by multiplying the sum of the adjusted scores by 2.5. The verification shall be 
considered successful when the test shows that for representative tasks identified in the analysis, 
the lower limit of the 95% confidence interval of the SUS average score is 85 or above. 
[V.CTS.138] 


4.3.10.4.2 Crew Interface Workload 


The spacecraft workload rating for nominal and off-nominal crew tasks shall be verified by 
analysis and test. A task analysis shall be performed to identify human activities required for 
nominal and off-nominal operation in the applicable mission phases and environments. The test 
shall consist of an evaluation by at least eight trained participants in a flight representative 
vehicle in the flight configuration performing each of the listed crew tasks and providing 
workload ratings on the Bedford Workload Scale. Tasks shall be grouped so that related tasks 
will be performed concurrently and sequentially as expected during actual in-flight operations. 
The evaluation period for each task shall span the duration of the task with participants providing 
their ratings at the end of this period. During workload evaluation tests, participants shall 
maintain performance error rates and completion times commensurate with the performance 
requirements of the particular task. For nominal tasks, the verification shall be considered 
successful when the test results show that for representative nominal tasks identified in the 
analysis, at least 6 of the 8 ratings are no greater than a rating of 3 on the Bedford workload 


Commercial Crew Program 
International Space Station Program Page 158 of 295 


ISS Crew Transportation and CCT-REQ-1130 
Services Requirements Document Revision: E-1 


scale, while up to 2 of the 8 ratings may exceed the rating of 3 (allowing workload ratings of 4, 
5, or 6 on the Bedford workload scale). For any ratings of 4, 5, or 6, the verification shall be 
considered successful only if consensus is reached by all of the participants indicating that the 
workload is acceptable. For off-nominal tasks, including contingency, the verification shall be 
considered successful when the test results show that for representative off-nominal tasks 
identified in the analysis, all of the subjects provide a rating of 6 or less on the Bedford scale. 
[V.CTS.139] 


4.3.10.4.3  Operability of Controls 


The operability of controls by a crewmember in their flight configuration shall be verified by 
analysis and demonstration. A task analysis shall be performed to identify human activities 
required for nominal and off-nominal operation in the applicable mission phases and 
environments. A demonstration of representative tasks shall be performed in a flight 
representative vehicle with crewmembers in their flight configuration executing tasks requiring 
crew control. The verification shall be considered successful when the demonstration shows 
crewmembers in their flight configuration can successfully complete representative tasks using 
the controls. [V.CTS.340] 


4.3.10.4.4 Design Induced Crew Errors 


Design-induced crew error rates shall be verified by analysis and test. A task analysis shall be 
performed to identify human activities required for nominal and off-nominal operation in the 
applicable mission phases and environments. The task analysis shall be used to identify potential 
human errors that can be encountered. The test shall consist of usability evaluations based on 
standard best practices (for example, Jakob Nielsen's "Usability Engineering," 1993). During the 
usability evaluation, a minimum of 20 participants (Faulkner, L., 2003) shall perform a set of 
onboard tasks in a flight representative vehicle. Usability evaluations should also include 
assessment of efficiency and satisfaction through collection of data, such as completion times 
and ratings on subjective questionnaires for use in differentiation of design-induced errors from 
errors related to human reliability. For purposes of this test, a task requiring evaluation will be 
defined as an activity driven by a procedure. The procedure consists of a series of task steps, 
where a task step will be defined as a single instruction to the crewmember, as is typical of 
current space flight procedures. Participants shall maintain task completion times commensurate 
with the performance requirements of the particular task. The percentage of erroneous task steps 
for each participant shall be calculated by dividing the number of erroneous task steps and 
incomplete task steps by the total number of task steps and multiplying the result by 100. The 
percentage of participants committing each erroneous task step shall be calculated by dividing 
the number of participants committing each erroneous task step by the total number of 
participants and multiplying the result by 100. The verification shall be considered successful 
when the results of the analysis and test show that the percentage of erroneous task steps per 
participant is no greater than 5% and the percentage of participants who committed each 
erroneous task step is no greater than 10%. [V.CTS.335] 


4.3.10.4.5 Emergency Annunciations 


The spacecraft's visual and auditory annunciations of emergency, warning, and caution events 
shall be verified by analysis, test and demonstration. The analysis shall determine the alarm 
categories triggered by each hazardous event defined in CCT-REQ-1130 section 4.3.2.4.1. The 
test shall determine if visual and auditory annunciators conform to section 9.4.4.3 of SSP 50005, 
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International Space Station Flight Crew Integration Standard. The demonstration shall be 
performed using flight representative software and hardware and each emergency, warning, and 
caution events. The verification shall be considered successful when the analysis, test, and 
demonstration show that each emergency, warning, and caution event triggers the correct visual 
and auditory annunciations according to section 9.4.4.3 of SSP 50005, International Space 
Station Flight Crew Integration Standard. [V.CTS.142] 


4.3.10.4.6 Annunciator Test 


The spacecraft notification of system failure of visual and auditory annunciators shall be verified 
by demonstration. A demonstration shall be performed with flight representative software and 
hardware. The demonstration shall initiate a test of the visual and auditory annunciators and 
observe the response. A demonstration shall then simulate failures of the visual and auditory 
annunciators, and then initiate a test of the visual and auditory annunciators and observe the 
response. The verification shall be considered successful when the demonstrations show that the 
system provides a response consistent with the state of the annunciators. [V.CTS.143] 


4.3.10.4.7 Protect for Inadvertent Operation 


Inadvertent operation shall be verified by analysis, inspection and demonstration. A hazard 
analysis shall identify controls whose inadvertent operation would lead to a catastrophic event or 
an abort. The inspection and the demonstration shall be performed using flight-configuration 
hardware and software. The demonstration shall simulate inadvertent inputs using flight 
representative hardware and software. The verification shall be considered successful when the 
analysis, inspection and demonstration show that controls that have been identified through the 
hazard analysis as requiring protection are prevented from inadvertent operation. [V.CTS.149] 


4.3.10.4.8 Annunciator Intelligibility 


Auditory speech annunciations and communications intelligibility shall be verified by analysis 
and test. The analysis shall derive the nominal background noise spectrum for testing for each 
mission phase. The test shall be made between the flight representative vehicle in the flight 
configuration and the CVCC through a flight representative communications network using the 
methodology given in ANSI S$3.2-2009. The test shall apply to the annunciators that are in-use 
during each mission phase. The verification shall be considered successful when the test and 
analysis indicate a 90% word identification level at the ear of the listener throughout the 
habitable volume. [V.CTS.119] 


4.3.10.5 Acoustics 
4.3.10.5.1 Acoustics Limits for Launch, Entry, and Abort 
4.3.10.5.1.124-Hour Noise Exposure Limit 


The CTS's noise dose limits at the crewmember's ear for launch and entry shall be verified by 
test and analysis. The noise level as a function of time for the launch, entry, and ascent abort 
measured at the crewmember's ears shall be determined by analysis. The analysis shall estimate 
the noise level as a function of time at the crewmember's ear by combining significant noise 
sources from estimates of Launch vehicle noise and external flow boundary layer noise and 
including acoustic insertion losses of acoustic isolation and protective devices. The CTS noise 
sources shall be determined by test. Acoustic insertion losses of the pressure shell and other 
materials shall be determined by test. The effectiveness of hearing protection, headsets, and 
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helmets shall be determined by test. Noise levels for the balance of the 24-hour calculation 
period shall be assumed to be 65 dBA. The verification shall be considered successful when 
tests and analysis indicate that the 24-hour noise dose associated with launch, entry, and ascent 
abort predicted at the crewmember's ears is 100% or less. [V.CTS.228] 


4.3.10.5.1.2 Launch/Entry SPL Limit 


The CTS's hazardous noise limit for launch, entry, and abort shall be verified by test and 
analysis. The maximum noise level measured at the crewmember's ears shall be determined by 
analysis. The analysis shall estimate the noise level as a function of time at the crewmember's 
ear by combining significant noise sources from estimates of Launch Vehicle and external flow 
boundary layer noise and including acoustic insertion losses of acoustic isolation and protective 
devices. The CTS noise sources shall be determined by test. Acoustic insertion losses of the 
pressure shell and other materials shall be determined by test. The effectiveness of hearing 
protection, headsets, and helmets shall be determined by test. The verification shall be 
considered successful when the tests and analysis indicate that the maximum level predicted at 
the crewmember's ears is 105 dBA or less during launch and entry, and 115 dBA or less during 
ascent abort. [V.CTS.229] 


4.3.10.5.1.3 Impulse Noise Limit - Ear 


The CTS impulse noise limit for launch and entry shall be verified by test and analysis. The 
impulse noise level measured at the crewmember's ears shall be determined by flight test. The 
test and analysis shall consist of estimating the impulse noise level at the crewmember's ear by 
combining significant noise sources and including acoustic insertion losses of acoustic isolation 
and protective devices. The ignition noise should be determined by test. Acoustic insertion 
losses of the pressure shell and other materials shall be determined by test. The effectiveness of 
hearing protection, headsets, and helmets shall be determined by test. Peak-hold sound pressure 
level measurements shall be made using a Type | sound level meter. The frequency response of 
the sound level meter shall extend to at least 6 Hz at its lower limit. Formal verification is not 
required for equipment with impulse noises that have peak overall SPLs of less than 110 dB. 
The verification shall be considered successful when the test and analysis results indicate that the 
peak overall sound pressure level predicted at the crewmember's ears is less than 140 dB. 
[V.CTS.230] 


4.3.10.5.1.4 Infrasonic Noise Limit 


The CTS's infrasonic noise limit shall be verified by test and analysis. The maximum noise level 
measured at the crewmember's ears shall be determined by analysis. The analysis shall estimate 
the maximum sound level at the crewmember's ear by combining significant noise sources from 
estimates of launch vehicle noise and external flow boundary layer noise, and including acoustic 
test of integrated space vehicle noise sources. Acoustic insertion losses of the pressure shell and 
other materials shall be determined by test. The effectiveness of hearing protection, headsets, 
and helmets is not allowed for this verification. Sound pressure measurements shall be made 
over a frequency range from 1 to 20 Hz, using a Type | integrating-averaging sound level meter 
at expected work station head locations. The infrasonic noise level shall be measured via a Leq 
(slow time weighting). The verification shall be considered successful when the test and analysis 
indicate that the unweighted overall sound pressure level is 150 dB or less at each expected work 
station head-location. [V.CTS.231] 
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4.3.10.5.2 Acoustic Limits for the Orbit and Post-Landing Phases 
4.3.10.5.2.1 Noise level for Communication 


The spacecraft environment for intercabin communication shall be verified by test. The test shall 
be conducted in the flight-vehicle in the loudest nominal condition with all cabin equipment 
operating consistent with mission phase. Integrated portable equipment, stowage, vehicle 
installations, and closeouts shall be installed for the test. Noise produced by active payloads and 
Government Furnished Equipment shall be included by test or analysis. Impulse noise, alarms, 
and voice communications shall be excluded from the test. Hardware shall be operated across the 
expected range of operational settings including settings corresponding to the expected highest 
noise levels. Measurements shall be made at expected work and sleep station head locations, the 
center of the pressurized volume, and throughout the habitable volume to determine a spatial 
average. Measurement locations shall be no closer than 30 cm from each other and no closer than 
8 cm from any surface. The spatial average shall be based on incoherent sound power addition 
(i.e., average of pressure-squared values). The spatial average shall include measurements from 
the locations above and a sufficient number of additional locations to achieve a + 2 dB 90% 
confidence interval within each octave band from 250 Hz to 16 kHz. The verification shall be 
considered successful when field testing indicates that: 


a. the spatially-averaged SPLs (average of pressure-squared values) throughout the habitable 
volume do not exceed the NC-52 levels given in Figure 3.10.5.2.1-1 and Table 3.10.5.2.1-1 


b. no octave band sound pressure level measured at any location or at the maximum level 
location (i.e., the location of the maximum A-weighted overall sound pressure level found 
with a handheld sound level meter) within the entire habitable volume is more than 4 dB 
above the NC-52 levels specified in Figure 3.10.5.2.1-1 and Table 3.10.5.2.1-1, and 


c. the intent of requirements Q.1.2, Q.1.5, and Q.6.1 are satisfied. [V.CTS.342] 
4.3.10.6 Radiation 
4.3.10.6.1 Ionizing Radiation 
4.3.10.6.2 Radiation Design 
4.3.10.6.2.1 Radiation Protection 


The CTS's crewmember radiation exposure shall be verified by analysis. The analysis shall be 
performed through the use of a model with the following components: 


Design Environment: SSP 30512, Space Station Ionizing Radiation Design Environment. 


Transport Code: Latest transport code (e.g., 2005 HZETRN). 


Vehicle Geometry: Standard CAD model of the vehicle structure, hardware, stowage, and 
commercial equipment. This includes materials specification sufficient to derive chemical 
composition and bulk density for each instance/part in the design. The vehicle, as analyzed, shall 
be representative of a standard configuration for vehicle components, equipment, and stowage 
items, as well as a minimum crew complement placed within the habitable volume. 


Shield Evaluation/Mass Distribution Evaluation: Barrier Thickness Evaluator (BTE) code. 


Human Geometry: 50th percentile female model. 


Effective dose shall be calculated as a quantity, 
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E=)\w,H, 
T 
Where, the equivalent dose, Hr, is defined as 
H, =Q(L)D, p 


Dr. is the dose averaged over a specific organ or tissue (T) due to radiation (R). 


The tissue weighting factor wr is given in Table 4.3, wr for Different Tissues and Organs, in 
National Council on Radiation Protection and Measurements (NCRP) Report Number 132. 


Q(L) is the radiation quality factor as a function of Linear Energy Transfer (LET) in water as 
specified in NCRP Report 132, Table 4.2 “Quality Factor-LET Relationships.” When performing 
this analysis, the assessment shall also include the use of radioactive isotopes and radiation 
producing equipment onboard the spacecraft. The verification shall be considered successful 
when the analysis shows that the protection from radiation exposure to ensure that the effective 
dose (tissue average) to any crewmember within the vehicle is consistent with the ALARA 
principle. [V.CTS.239] 


4.3.10.6.3 Non-Ionizing Radiation 
4.3.10.6.3.1 RF Non-Ionizing Radiation Exposure Limits 


The CTS's crew exposure to radio-frequency electromagnetic fields shall be verified by test and 
analysis. A hazard analysis shall be performed in the design phase to ensure that all potential 
radiation sources have been identified according to the defined operational RF environment. A 
model/analysis shall be generated that comprises the defined RF environment over all flight 
phases, including additive and synergistic effects. The model shall be used to predict RF 
exposure levels in crew accessible areas, both internal and external to the spacecraft. During the 
physical certification process, inter-system electromagnetic compatibility testing will be 
performed at the vehicle level, in which the vehicle itself is radiated with the defined RF 
environment enveloping all flight phases. As part of that measurement process, instrumentation 
will be located inside the vehicle to sample the electromagnetic field that penetrates the vehicle. 
This data will then be made available for comparison to the model/analysis results. The 
verification shall be considered successful when the analysis and test results demonstrate that 
crew exposures are within the limits specified Figure 3.10.6.3.1-1. [V.-CTS.241] 


4.3.10.6.3.2 Laser Exposure Limits 


The verification for laser exposure limits shall be completed by any one of the following 
methods: 


a. Inspection of spacecraft equipment documentation. Verification shall be considered 
successful if the documentation shows there are no lasers on the spacecraft. 


b. Ocular and dermal exposure from laser systems shall be verified by analysis. The analysis 
shall be performed as defined by ANSI Z136.1-2007, American National Standard for Safe 
Use of Lasers. A necessary input for the analysis is the measurement procedures used for the 
classification of the laser, as specified in ANSI Z136.4, 2005, American National Standard 
for Recommend Practice for Laser Safety Measurements for Hazard Evaluation. 


The verification shall be considered successful when the analysis shows that ocular exposure is 
within the limits of Maximum Permissible Exposure (MPE) values for eye and skin listed in 
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ANSI Z136.1-2007 considering all credible exposure scenarios and without protective 
equipment. [V.CTS.242] 


4.3.10.6.4 Incoherent Electromagnetic Radiation 
4.3.10.6.4.1 Retinal Thermal Injury from Visible and Near Infrared Source 


Crewmember exposure to visible and near infrared sources limits shall be verified by test and 
analysis. The test shall measure the transmittance of all transparent and translucent apertures and 
radiance of artificial sources from at least 385-1,400 nm in I1-nm increments. Transmittance 
measurements may be taken in a flight-representative vehicle using witness samples in the flight 
configuration if the witness samples are large enough to capture the enhanced transmittance 
realized from multi-pane reflections; otherwise, transmittance measurements shall be performed 
on flight articles. Spectral radiance measurements of artificial sources shall be done by type and 
lot. The analysis shall include calculation of the limits indicated in the requirement using the 
transmittance and radiance values obtained during the test. The verification shall be considered 
successful when the analysis shows that the limits calculated from the equations in this 
requirement are maintained within the applicable spectrum (385-1,400 nm). [V.CTS.244] 


4.3.10.6.4.2 Visible Radiation Limits 


Crewmember exposure limits shall be verified by test and analysis. The test shall measure the 
transmittance of all transparent and translucent apertures and radiance of artificial sources from 
at least 305-700 nm in 1-nm increments. Transmittance measurements may be taken in a flight- 
representative vehicle using witness samples in the flight configuration if the witness samples are 
large enough to capture the enhanced transmittance realized from multi-pane reflections; 
otherwise, transmittance measurements shall be performed on flight articles. Spectral radiance 
measurements of artificial sources shall be done by type and lot. The analysis shall include 
calculation of the limits indicated in the requirement using the transmittance and radiance values 
obtained during the test. The verification shall be considered successful when the analysis shows 
that the limits calculated from the equations in this requirement are maintained within the 
applicable spectrum (305-700 nm). [V.CTS.245] 


4.3.10.6.4.3 Thermal Injury from Infrared Radiation 


Crewmember exposure limits shall be verified by test and analysis. The test shall measure the 
transmittance of all transparent and translucent apertures and radiance of artificial sources from 
at least 770-3,000 nm in 1-nm increments. Transmittance measurements may be taken in a 
flight-representative vehicle using witness samples in the flight configuration if the witness 
samples are large enough to capture the enhanced transmittance realized from multi-pane 
reflections; otherwise, transmittance measurements shall be performed on flight articles. 
Spectral radiance measurements of artificial sources shall be done by type and lot. The analysis 
shall include calculation of the limits indicated in the requirement using the transmittance and 
radiance values obtained during the test. The verification shall be considered successful when 
the analysis shows that the limits calculated from the equations in this requirement are 
maintained within the applicable spectrum (770-3,000 nm). [V.CTS.246] 


4.3.10.6.4.4 Ultraviolet (UV) Exposure for Unprotected Eye or Skin 


Crewmember exposure limits shall be verified by test and analysis. The test shall measure the 
transmittance of all transparent and translucent apertures and radiance of artificial sources from 
at least 180-400 nm in 1-nm increments. Transmittance measurements may be taken in a flight- 
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representative vehicle using witness samples in the flight configuration if the witness samples are 
large enough to capture the enhanced transmittance realized from multi-pane reflections; 
otherwise, transmittance measurements shall be performed on flight articles. Spectral radiance 
measurements of artificial sources shall be done by type and lot. The analysis shall include 
calculation of the limits indicated in the requirement using the transmittance and radiance values 
obtained during the test. The verification shall be considered successful when the analysis shows 
that the limits calculated from the equations in this requirement are maintained within the 
applicable spectrum (180-400 nm). [V.CTS.247] 


4.3.10.7 RESERVED 

4.3.10.8 RESERVED 

4.3.10.9 RESERVED 

4.3.10.10 Operational Limitations 
4.3.10.10.1 Crew Awake Period 


The CTS's provision of a crew-awake period of 16 hours or less on any free flight day except 
landing day shall be verified by inspection. The inspection shall consist of a review of the 
nominal mission flight plan (including a task by task review of activity durations) from launch 
day until landing for those days where the crew is not in the ISS for full days. The verification 
shall be successful when the inspection shows the nominal mission flight plan schedules 16 
hours or less of crew-awake time, including | hour of post-sleep and | hour of pre-sleep, 30 
continuous minutes per meal for consumption of 3 meals per day, additional continuous time for 
meal preparation, crew sleep scheduled no earlier than 3 hours after launch, and no nominally 
planned docking or undocking/separation operations prior to post-sleep and breakfast on any 
flight day. [V.CTS.108] 


4.3.10.10.2 Landing Day Crew Awake Period 


The CTS's provision of a crew-awake period of 18 hours or less on landing day shall be verified 
by inspection. The inspection shall consist of a review of the nominal mission flight plan 
(including a task by task review of activity durations) for landing day. The verification shall be 
successful when the inspection shows the nominal mission flight plan schedules 18 hours or less 
of crew-awake time including 6 hours post-landing egress, 1 hour post-sleep, 30 continuous 
minutes per meal for consumption, with additional continuous time for meal preparation, and no 
nominally planned deorbit operations prior to post-sleep and breakfast on landing day. 
[V.CTS.347] 


4.3.10.10.3 Crew Sleep Period 


The CTS's provision of a crew minimum of 8 continuous hours of sleep for all crew at the same 
time shall be verified by inspection. The inspection shall consist of a review of the nominal 
mission flight plan (including a task by task review of activity durations) from flight day 1 (FD1) 
until landing day for those mission days where the spacecraft is not mated to ISS for the full 
crew day. The verification shall be successful when the inspection shows the nominal mission 
flight plan schedules a minimum of 8 continuous hours of sleep for all crew during the same 
sleep period on any free flight day. [V.CTS.320] 
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4.3.10.10.4 Crew Limits in Launch Orientation 


The limitation of 5 hours in the launch orientation with crew on back shall be verified by 
inspection. The inspection shall consist of a review of the timelines and crew configurations 
from vehicle ingress until launch. The verification shall be successful when the inspection 
shows the timelines and configurations of the crewmembers has the crew on their backs with feet 
elevated for 5 hours or less in the launch orientation in the pre-launch phase (excluding 
subsequent safing and egress time for a launch scrub). [V.CTS.348] 


4.3.10.11 Internal Atmosphere 
4.3.10.11.1 General 
4.3.10.11.1.1 Habitability Limits 


a. Cabin Pressure - The spacecraft maintenance of pressure shall be verified by analysis and 
test. The analysis shall show that the pressure control system can maintain the pressure 
within the specified range and that adequate consumables are available to support the 
maximum duration mission. The test shall show that the integrated system can flow oxygen 
and nitrogen to maintain the cabin pressure. The verification shall be considered successful 
when the test and analysis data show that the vehicle can maintain pressure of the internal 
atmosphere within the limits throughout all flight phases except during quiescent docked 
operations. 


b. Cabin ppO>2 - The spacecraft oxygen partial pressure levels in the cabin shall be verified by 
analysis and test. The analysis shall show that the pressure control system can maintain the 
oxygen partial pressure within the specified range and that adequate consumables are 
available to support the maximum duration mission. The test shall show that the integrated 
system can flow oxygen to maintain the cabin partial pressure of oxygen while oxygen is 
being removed by a metabolic simulator in a flight configuration with a flight representative 
ventilation system. The test shall be performed until a steady state level is achieved. The 
verification shall be considered successful when the test and analysis data show that the 
vehicle can maintain the partial pressure of oxygen within the limits throughout all flight 
phases except during quiescent docked operations. 


c. Cabin Depress/Repress Rates - The spacecraft rate of total pressure change shall be verified 
by analysis. The analysis shall include a review of the vehicle design and operations and an 
evaluation of the worst-case scenario for pressure change during nominal operations. The 
verification shall be considered successful when the analysis shows that the spacecraft will 
not exceed the pressure change described in the requirement. 


d. Cabin ppCO> - Spacecraft control of the partial pressure of carbon dioxide shall be verified 
by analysis and test. An analysis, in the form of a simulation, shall evaluate the vehicle’s 
ability to maintain the cabin carbon dioxide levels within the specified range under the 
metabolic loads specified in 3.10.11.2.4 for the maximum duration mission. The test shall 
evaluate flight representative cabin ventilation hardware and carbon dioxide removal 
hardware in the flight configuration under simulated metabolic load until a steady state level 
is achieved. The verification shall be considered successful when the test and analysis shows 
that the spacecraft can maintain the carbon dioxide levels to the limits in the requirement 
throughout all flight phases except during quiescent docked operations. 
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e. Cabin Temperature - Spacecraft atmospheric temperature control within the specified range 
shall be verified by analysis. An analysis, in the form of a simulation, shall evaluate the 
vehicle’s ability to regulate the vehicle cabin temperature throughout the flight envelope 
under the metabolic loads specified in 3.10.11.2.4. The verification shall be considered 
successful when the analysis shows that the temperature can be maintained within the 
specified range during all nominal unsuited flight operations, excluding quiescent docked 
operations and post-landing. 


f. Cabin Relative Humidity - Spacecraft relative humidity control shall be verified by analysis. 
An analysis, in the form of a simulation, shall evaluate the vehicle’s ability to regulate the 
vehicle relative humidity throughout the flight envelope under the metabolic loads specified 
in 3.10.11.2.4. The verification shall be considered successful when the analysis shows that 
the spacecraft can maintain the average relative humidity levels within the specified range 
during all nominal unsuited flight operations, excluding quiescent docked operations and 
post-landing. 


g. Cabin Velocities for Mixing - The spacecraft capability to maintain a ventilation rate within 
the spacecraft shall be verified by analysis. The analysis shall include a fluid dynamics 
model of the interior habitable volume and shall identify potential areas within the habitable 
volume with no air movement The analysis shall consider the ventilation rate only at a single, 
nominal setting for all fan speeds and diffusers. The verification shall be considered 
successful when the analysis establishes that two-thirds (66.7%) of the atmosphere velocities 
are between 4.57 m/min (15 ft/min) and 36.58 m/min (120 ft/min), no more than 5% of the 
velocities are less than 2.13 m/min (7 ft/min), and no more than 1% of the velocities are in 
excess of 60.96 m/min (200 ft/min) at a distance measured more than 0.15 m [6 inches]) from 
the vehicle walls during all mission phases, except during suited operations, toxic cabin 
events, or quiescent docked operations. [V.CTS.346] 


4.3.10.11.1.2 Cabin Pressure Maintenance during Leak 


The verification to support a cabin leak shall be accomplished by analysis. A consumables 
analysis shall show that adequate quantities of oxygen and nitrogen are available to maintain a 
cabin pressure of 55.2 kPa (8 psia) or greater with an equivalent cabin hole diameter of 0.64 cm 
(0.25 in) for the time required to execute an EDL. The analysis shall assume a Coefficient of 
Discharge greater than or equal to 0.72. A performance analysis shall show that the pressure 
control system can maintain the cabin pressure to greater than or equal to 55.2 kPa (8.0 psia) 
while supporting an equivalent cabin hole diameter of 0.64 cm (0.25 in). An operability analysis 
shall be performed to determine the systems required to execute a successful EDL. An analysis 
shall be performed to determine the required cooling for critical EDL systems in the reduced 
pressure environment. The verification shall be considered successful when the integrated 
analyses show that adequate oxygen and nitrogen consumables are available and supplied to the 
cabin within limits as defined in 3.10.11.2.2 and 3.10.11.2.3, while maintaining the cabin 
pressure above 55.2 kPa (8.0 psia), and that critical EDL systems will operate at 55.2 kPa (8.0 
psia) with an equivalent cabin hole diameter of 0.64 cm (0.25 in). [V.CTS.153] 


4.3.10.11.1.3 Return Contaminated Atmosphere within Limits 


The ability of the spacecraft to return the cabin atmosphere to the limits defined in Tables 
3.10.11.1.1-1 and 3.10.11.1.3-1 following the contamination of the cabin atmosphere when the 
hatch is closed, shall be verified by analysis. An analysis of likely fire and contamination 
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scenarios, as derived from a hazard analysis, shall determine the constituents and their 
concentration at the beginning of this operation. An analysis, in the form of a simulation, shall 
evaluate the vehicle’s ability to revitalize the atmosphere under the constituent load developed in 
the operational analysis. The verification shall be considered successful when the analysis shows 
the cabin contamination level can be lowered below the Table 3.10.11.1.3-1 limits and the cabin 
atmosphere can be returned to limits defined in Table 3.10.11.1.1-1. [V-CTS.152] 


4.3.10.11.1.4 Protect for Atmospheric Contingency 


The spacecraft's ability to provide atmospheric contingency protection shall be verified by 
analysis and inspection. The analysis shall determine the quantity of consumables required for 
each of the following events: 


a. Contaminated atmosphere event cleanup, which includes gas for emergency breathing 
apparatus, if applicable, and cabin purge of the entire pressurized volume (equivalent to a 
depress/repress of the entire pressurized volume) to return the atmosphere to within SMAC 
limits. 

b. Unrecoverable cabin leak, which includes gas to maintain cabin at or above 55.2 kPa (8.0 
psi). 

The verification shall be considered successful when inspection of the consumables budget 

shows the required quantities of consumables for the worst case of the two pressure events, in 


addition to those required for nominal and contingency operations defined in Section 3.4. 
[V.CTS.154] 


4.3.10.11.2 Detailed Pressurized Crew Cabin Requirements 
4.3.10.11.2.1 Crew Atmospheric Control 


The spacecraft cabin temperature and ventilation control by flight crew shall be verified by 
analysis and demonstration. The analysis shall evaluate the life support system and controls. 
The analysis shall determine the temperature and ventilation control authority throughout the 
flight envelope. The demonstration shall adjust the temperature and ventilation set points on 
flight representative vehicles. The verification shall be considered successful when the analysis 
shows that it the spacecraft can support multiple set points throughout all flight phases except 
during quiescent docked operations and the demonstration shows that the system responds to a 
change in set point. [V.CTS.157] 


4.3.10.11.2.2 O2 Limit 


The maintenance of the oxygen concentration to 24.1% by volume in the spacecraft cabin shall 
be verified by analysis. The analysis shall show the spacecraft can control oxygen concentration 
to 24.1% by volume or less, from a nominal cabin pressure per Table 3.10.11.1.1-1 to a cabin 
pressure of 7OkPA (10.2psia). The analysis shall account for system uncertainties such as cabin 
pressure and oxygen monitoring errors. The verification shall be considered successful when the 
analysis shows the system can control the oxygen concentration to 24.1% by volume or less, 
from a nominal cabin pressure per Table 3.10.11.1.1-1 to a cabin pressure of 7OkPA (10.2psia). 
[V.CTS.166] 


4.3.10.11.2.3 O2 Limit during Depressurization 


The maintenance of the oxygen levels in the spacecraft cabin shall be verified by analysis. The 
analysis shall show the spacecraft can control oxygen levels to greater than 17 kPa (2.4 psia) 
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partial pressure and less than 30% oxygen concentration while at reduced pressures from 70 to 
55 kPa (10.2 to 8.0 psia). The analysis shall account for system uncertainties such as cabin 
pressure and oxygen monitoring errors. The verification shall be considered successful when the 
analysis shows the system can control oxygen levels to greater than 17 kPa (2.4 psia) partial 
pressure and less than 30% oxygen concentration while at reduced pressures. [V.CTS.167] 


4.3.10.11.2.4 Accommodate Metabolic Loads 


The spacecraft's accommodation of metabolic loads shall be verified by analysis. The analysis 
shall identify the tasks, flight configurations, and associated metabolic rates of each 
crewmember. The analysis shall evaluate atmospheric ppO2, ppCO2, temperature, and relative 
humidity for the nominal phases while unsuited. The verification shall be considered successful 
when the analysis shows that the spacecraft is capable of accommodating the expected metabolic 
loads imposed by the crewmember, per Appendix F, "Metabolic Loads," while maintaining the 
required atmospheric conditions in Table 3.10.11.1.1. [V.-CTS.312] 


4.3.10.12 Contamination 
4.3.10.12.1 Measure Toxic Combustion Products 


The ability of the CTS to measure and display the specified atmospheric gas concentrations in 
real-time in the required ranges shall be verified by analysis and test. An analysis shall be 
performed to determine the measurement response time required to support operational 
decisions. The test shall evaluate the atmospheric monitoring instruments ability to measure the 
toxic product concentrations over the entire operating range to the accuracies specified in this 
requirement. The verification shall be considered successful when the test shows the 
measurement and display of atmospheric concentrations of the specified toxic combustion 
products over the specified ranges with the required accuracies in the time required to support 
operational decisions. [V.CTS.182] 


4.3.10.12.2 Use of Hazardous Chemicals 


The CTS's use of Toxic Hazard Level 3 or lower chemicals in the habitable volume of the system 
shall be verified by analysis. The analysis shall include a review of the materials and chemicals 
selected for spacecraft construction and their use in the operation of the vehicle. The verification 
shall be considered successful when the analysis shows Toxic Hazard Level 3 or lower chemicals 
are the only chemicals used in the habitable volume of the vehicle and that no decomposition 
products will be a Toxicological Hazard Level 4 in accordance with JSC 26895, Guidelines for 
Assessing the Toxic Hazard of Spacecraft Chemicals and Test Materials. [V.CTS.183] 


4.3.10.12.3 Gas Pollutant Limits 


The spacecraft's control of gaseous pollutants in the habitable volume shall be verified by 
analysis and test. The analysis shall evaluate the vehicle’s active control of the concentration of 
individual trace chemical contaminants introduced into the cabin according to the load defined 
by Table 4.3.10.12.3-1. The test shall provide the data used to derive actual equipment off- 
gassing rates. The test conducted according to SSP 41172, Qualification and Acceptance 
Environmental Test Requirements shall be used to determine the integrated vehicle equipment 
off-gassing generation load. The off-gassing rate data derived from the test and data relating to 
system chemical sources supersede the equipment off-gassing and system generation rates of 
Table 4.3.10.12.3-1. The verification of gaseous pollutant accumulation in the habitable 
atmosphere to below 1.0 T unit during all mission phases shall be considered successful when 
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the analysis shows the gaseous pollutant accumulation in the habitable volume meets 0.5 T units 
or less based on 7-day SMACs for the combined load of spacecraft system sources and metabolic 
loads (part a.) and when the analysis and test show the gaseous pollutant accumulation in the 
habitable volume meets 0.5 T units or less based on 7-day SMACs for off-gassing (part b.). 
[V.CTS.184] 


Table 4.3.10.12.3-1: Trace Chemical Containment Design Load 


GENERATION RATE 
CONTAMINANT scar eco OFFGASSING | METABOLIC | SYSTEM 
(mg/d-kg)> (mg/d-person) (mg/d) 
Methanol 90 1.3 x 10% 0.9 0 
Ethanol 2,000 7.8 x 103 4.3 0 
n-butanol 80 4.7 x 107 0.5 0 
Methanal (formaldehyde) 0.12 4.4 x 10° 0.4 0 
Ethanal (acetaldehyde) 4 1.1 x 10+ 0.6 0 
Benzene 1.5 2.5 x 10° 2.2 0 
Methylbenzene (toluene) 15 2x 10° 0.6 0 
Dimethylbenzenes (xylenes) 73 3.7 x 10° 0.2 0 
Dichloromethane 49 2.2 x 10° 0.09 0 
2-propanone (acetone) 52 3.6 x 10% 19 0 
Trimethylsilanol 4 1.7 x 10+ 0 0 
Hexamethylcyclotrisiloxane 90 1.7 x 107 0 0 
Ammonia 2 8.5 x 10° 50 160° 
Carbon monoxide 63 2x 10% 18 0 
a. 7-day Spacecraft Maximum Allowable Concentration from JSC 20584 dated November 2008. 
b. Offgassing rate is for the mass of internal, non-structural equipment. 
c. AMmonia generation by amine-containing system components, zero if no amine present. 


4.3.10.12.4 Particulate Control 


The limit of particulate in the internal atmosphere shall be verified by analysis. The analysis 
shall include a review of the vehicle cabin airflow and filtration design. The verification shall be 
considered successful when the analysis shows that the 24-hour average particulate concentration 
within the vehicle meets the specifications given for this requirement. [V.CTS.185] 


4.3.10.12.5 RESERVED 
4.3.10.12.6 Microbial Limits 


The limitation of microbial contaminants in the internal atmosphere shall be verified by analysis. 
The analysis shall include a review of the vehicle cabin airflow and filtration design. The 
verification shall be considered successful when the analysis shows that the average continuous 
air flow within the vehicle can remain at or above 20 CFM per person of air that has been 
cleaned to have at least 99.97% of airborne particles 0.3 um and larger in diameter/size removed. 
[V.CTS.187] 


4.3.10.12.7 RESERVED 
4.3.10.12.8 RESERVED 
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4.3.10.12.9 Condensation Limits 


The condensation persistence on CTS interior surfaces shall be verified by analysis. The 
analysis shall consider crew induced metabolic loads in Appendix F, Table F-1 "Crewmember 
Metabolic Loads -Standard Day." The analysis shall include a thermal analysis to determine 
expected water on internal surfaces. The verification shall be considered successful when the 
analysis shows that condensation persistence is limited to 1 hour a day on surfaces within the 
internal volume throughout all flight phases except during quiescent docked operations. 
[V.CTS.190] 


4.3.10.12.10 RESERVED 

4.3.10.13 RESERVED 

4.3.10.14 Hatches and Doorways 
4.3.10.14.1 Hatch Bi-directional Operability 


Hatch operability by a single person from both inside and outside the spacecraft during all flight 
phases shall be verified by demonstration. The demonstration shall occur in a flight 
representative vehicle with the ground and flight crews in their flight configurations. The 
demonstration shall consist of a subject performing the following four tasks: unlatching and 
fully opening each hatch from the inside, unlatching and fully opening each hatch from the 
outside, closing and latching each fully-opened hatch from the inside, and closing and latching 
each fully-opened hatch from the outside. The verification shall be considered successful when 
the demonstration shows that hatch operation can be accomplished by a single person from both 
inside and outside the spacecraft during all flight phases. [V.CTS.170] 


4.3.10.14.2 Hatch Windows 


The provision of a hatch window that provides for direct visual, non-electronic observation of 
the opposite side of a hatch shall be verified by analysis and demonstration. The analysis shall 
derive the field of view necessary to observe the environment on the opposite side of the hatch 
with respect to the hatch in which it is installed. The demonstration shall confirm the 
observation of targets throughout the field of view both from the inside looking outward and the 
outside looking inward. The verification shall be considered successful when the demonstration 
shows that the direct visual, non-electronic field of view provided by the window meets the field- 
of-view, as determined by the analysis, required to observe the environment on the opposite side 
of the hatch in both viewing directions. [V.CTS.174] 


4.3.10.15 RESERVED 
4.3.10.16 Crew Size, Mass, and Strength 
4.3.10.16.1 Anthropometric Dimensions Standards 


The CTS's accommodation of the anthropometric ranges in Appendix D and applicable suit 
conditions shall be verified by inspection, analysis, and test. Inspection shall include a review of 
designs, drawings, and flight representative vehicles and extraction of measurements to compare 
against the information contained in Appendix D and against CTS-developed suit values. An 
integrated task and worksite analysis shall be performed on all crew functional areas. The task 
analysis shall include a determination of potential clothing required to be worn for each task, as 
well as, define a subset of the anthropometric dimensions in Appendix D, Table D-1 and D-2 that 
are critical for each task. The test shall measure a human subject while physically interacting 
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with a crew functional area within a flight representative vehicle in the flight configuration. The 
test results shall be verified by means of population analytical methods, such as is described in 
JSC 65995, section 4.5.2.4 Evaluate the Design Using Population Analysis. The verification 
shall be considered successful when the inspection, analysis, and test show that the 
anthropometric ranges in Appendix D and applicable suited conditions have been met for the 
crew wearing all required protective clothing; and crew can fit, access, reach, view, and operate 
the human systems interfaces. [V.CTS.193] 


4.3.10.16.2 Crew Body Mass Standards 


The CTS's implementation of the body mass data to the design shall be verified by analysis. The 
analysis shall include spacecraft, cargo, crew mass, flight performance, and the center of gravity 
of the crewed launch vehicles and spacecraft to ensure the design is capable of delivering the 
entire system mass. The analysis shall evaluate the designs and load computations to compare 
against the information in Appendix D, "D-3 Body Mass" and "D-5 Body Segment Mass of a 
Crewmember" to determine if damage will occur on human systems interfaces that are normally 
subjected to high forces during nominal and off-nominal operations. The verification shall be 
considered successful when the analysis shows that the system’s delivered-crew mass is equal to 
or greater than the maximum total crew mass per Appendix D, "D-4 Whole Body Mass for 
Multiple Crew" with the crew wearing any required protective clothing and the spacecraft 
systems human interfaces accommodate the maximum mass of an individual crewmember per 
Appendix D, "D-3 Body Mass.” [V.CTS.194] 


4.3.10.16.3 Crew Operation Loads 


The spacecraft's hardware and equipment actuation loads shall be verified by analysis and test. 

A task analysis shall be performed to identify human activities required for nominal and off- 
nominal operation that must be accomplished with each type of hardware and equipment 
throughout the mission. The verification shall be considered successful when the test of 
hardware shows the forces required for the operations are below the limit in the appropriate table 
in Appendix E for the task and flight configuration that requires that operation. [V.CTS.195] 


4.3.10.16.4 Withstand Crew Loads 


The structural integrity of crew interfaces shall be verified by analysis and test. An analysis shall 
determine the type of strength by which the crew would apply loads to the crew interfaces in 
nominal and off-nominal tasks. Crew interfaces shall be load tested to the levels in Appendix E 
for those types of strength. The verification shall be considered successful when the test shows 
that the interfaces can withstand maximum crew operation loads as defined in Appendix E, Table 
E-1. [V.CTS.196] 


4.3.10.17 Crew Support Equipment 
4.3.10.17.1 Trash Management 


The spacecraft's provisions for containing and disposing of expected trash shall be verified by 
analysis, inspection and demonstration. A task analysis shall be performed to identify trash 
management activities in the applicable mission phases and environments. An analysis shall be 
performed for trash management design to confirm that expected trash types and volumes are 
characterized and that trash containment designs are appropriate for the trash types, 
environments and durations of containment. Engineering drawings and models shall be 
inspected to verify these components have been incorporated in accordance with all trash 
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management activities and supplies identified in the task analysis. The demonstration shall be 
performed using a flight representative trash containment system and trash, including odor 
sources, while exercising expected trash operations for the duration expected until trash disposal. 
The demonstration shall evaluate operator use of the trash management system and that trash, 
particularly hazardous, cannot be inadvertently released. The verification shall be considered 
successful when analysis, inspection and demonstration show that the trash management system 
contains expected trash types and controls odors. [V.CTS.198] 


4.3.10.17.2 Sleep Accommodations 


The spacecraft's provisions for crew sleep shall be verified by analysis and inspection. An 
analysis shall be performed to determine sleep functions, operations, environment, and 
accommodations required. The analysis shall assess light, noise, and vibration-levels during the 
sleep period. Engineering drawings and models shall be inspected to verify the resulting sleep 
components used to enhance the sleep environment have been incorporated in the design. The 
verification shall be considered successful when the analysis and inspection show that the cabin 
environment and design accommodate crew sleep. [V.CTS.199] 


4.3.10.17.3 RESERVED 
4.3.10.17.4 Body Waste Management 


The spacecraft's provision of a body waste management system shall be verified by analysis, 
demonstration, and inspection. A task analysis shall be performed to determine body waste 
management operations, functions and accommodations in applicable mission phases and 
environments. An analysis shall be performed to confirm that expected body waste containment 
designs are appropriate for the waste types and environments. Engineering drawings and models 
shall be inspected to verify these components have been incorporated in accordance with all 
body waste management activities and supplies identified in the task analysis. Demonstrations 
shall be performed using flight representative hardware in the flight configuration while 
exercising body waste management activities. The demonstration will show that an operator can 
use the body waste management system and that all particles are contained. A demonstration of 
waste stowage for the expected duration shall evaluate system odor control. Use of a shortened 
test period shall be justified by analysis. The verification shall be considered successful when 
the demonstration and inspection shows that a body waste management system has been 
provided and includes stowage, accommodation, functionality, and disposal of body waste 
management events and supplies for the quantities and rates found in Table 3.10.17.4-1. 
[V.CTS.203] 


4.3.10.18 RESERVED 
4.3.10.19 Water 
4.3.10.19.1 Potable Water Physiochemical Limits 


The spacecraft's physiochemical potable water quality shall be verified by test and analysis. The 
test shall include evaluation of a flight-representative water system for a length of time equal to 
the longest period expected between pre-flight preparation of potable water and post-flight crew 
recovery. Use of a shortened test period shall be justified by analysis. Samples shall be collected 
from all locations throughout the water system to which the crew may be exposed to verify 
compliance. These tests shall be conducted using standard laboratory techniques described in 
ISBN 0875530478, Standard Methods for Examination of Water and Wastewater, American 
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Public Health Association or alternate methodology that will provide comparable data. The 
verification shall be considered successful when test data are compliant with Appendix G, Table 
G-1, "Potable Water Physiochemical Limits" and analysis shows that results from a short- 
duration test can be considered equivalent to those of a full-duration test. [V.CTS.205] 


4.3.10.19.2 Potable Water Microbial Limits 


The spacecraft's microbiological water quality shall be verified by test and analysis. The test 
shall include evaluation of a flight-representative water system for a length of time equal to the 
longest period expected between pre-flight preparation of potable water and post-flight crew 
recovery. Use of a shortened test period shall be justified by analysis. Samples shall be 
collected from all locations throughout the water system to which the crew may be exposed to 
verify compliance. These tests shall be conducted using standard laboratory techniques 
described in ISBN 0875530478, Standard Methods for Examination of Water and Wastewater, 
American Public Health Association or alternate methodology that will provide comparable data. 
The verification shall be considered successful when test data are compliant with Table 
3.10.19.2-1, "Potable Water Microbiological Limits" and analysis shows that results from a 
short-duration test can be considered equivalent to those of a full-duration test. [V.CTS.206] 


4.3.10.19.3 Nominal Mission Water Provisions 


The spacecraft's provisioning of potable water at the specified temperatures shall be verified by 
analysis. The analysis shall determine the temperature of the water to be used for consumption, 
hygiene, and medical use during applicable mission phases. The verification shall be considered 
successful when the analysis shows that potable water can be provided between 18 °C (64.4 °F) 
and 28 °C (82.4 °F) and sufficient volume and mass capacity for stowage of a minimum of 2.6 L 
(88 fl oz) of potable water per crewmember per mission day for consumption and hygiene use 
and 1.0 L (total) of potable water for medical use, in addition to other potable water quantity 
requirements. [V.CTS.207] 


4.3.10.19.4 Water Monitoring 


The spacecraft's potable water sampling capability shall be verified by inspection and analysis. 
The inspection will include a review of spacecraft and potable water system designs to ensure 
potable water sample collection during pre-flight ground processing, in-flight, and post-flight 
phases. The analysis shall determine the amount of potable water stowage on the vehicle for the 
design reference mission utilizing maximum crew size and maximum mission duration. The 
verification shall be considered successful when the inspection shows capability to perform 
potable water sample collection and delivery of pre-flight, in-flight, and post-flight samples to 
NASA or a NASA-approved laboratory and the analysis shows sufficient volume and mass 
capacity for stowage of a minimum of 3.5 L of potable water, or approved alternative quantity, 
per mission for water sampling, in addition to all other potable water quantity requirements. 
[V.CTS.208] 


4.3.10.19.5 Water for Fluid Loading 


The spacecraft's provisioning of the specified quantity of potable water shall be verified by 
analysis. The analysis shall determine the total amount of potable water stowage on the 
spacecraft for the DRM utilizing maximum crew size and maximum mission duration. The 
verification shall be considered successful when the analysis shows sufficient volume and mass 
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capacity for stowage of 1.4 L (48.0 fl oz) per crewmember for Earth reentry fluid loading for 
each of two deorbit attempts. [V.CTS.210] 


4.3.10.19.6 Post-Landing Water 


The spacecraft's provisioning of the specified quantity of potable water shall be verified by 
analysis. The analysis shall determine the total amount of potable water stowage on the 
spacecraft for the DRM utilizing maximum crew size and maximum mission duration. The 
verification shall be considered successful when the analysis shows sufficient volume and mass 
capacity for stowage of a minimum of 1.0 L (33.8 fl oz) of potable water per crewmember for 
each 8-hour period of the entire post-landing crew recovery period, and that this water is 
immediately accessible to crewmembers in their landing configuration, in addition to all other 
potable water quantity requirements. [V.CTS.211] 


4.3.10.20 Crew Workspace/Stowage 
4.3.10.20.1 RESERVED 
4.3.10.20.2 Habitable Space Sizing 


The spacecraft's provision of work and habitable space, stowage, and physical accommodation 
shall be verified by analysis, inspection, and demonstration. A task analysis shall be performed 
to identify human activities required for nominal and off-nominal operation in the applicable 
mission phases and environments. An analysis shall be performed to show the functional 
arrangement of locations and the allocation of volumes to support crew operations are consistent 
with Appendix K range of motion constraints. The inspection shall include the review of 
designs, drawings, CAD 3D models, and flight representative vehicles and extraction of 
measurements to compare against the information in Appendix K, "Range of Motion Data." A 
demonstration shall be performed of critical expected mission tasks in a flight representative 
vehicle in the flight configuration. The verification shall be considered successful when the 
analysis, inspection, and demonstration show that the measurements have been met and that the 
crew, wearing all required protective clothing, can complete the tasks identified within the range 
of motion constraints. [V.CTS.213] 


4.3.11 Ground Support Equipment (GSE) 
4.3.11.1 Design of GSE 


Verification that the design of the GSE does not invalidate flight hardware certification shall be 
verified by analysis and inspection. An analysis shall be performed to determine the hazards 
created by GSE interfaces to flight hardware. The verification shall be considered successful 
when an analysis and inspection determines that all hazards due to the use of GSE are controlled 
to preclude any risk of invalidation of flight hardware certification. [V.CTS.314] 
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Appendix A: Acronyms 
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Appendix B: 1100 Series Definitions 


Term 


Abort The forced early return of the crew when failures or the existence of 
uncontrolled catastrophic hazards prevent continuation of the mission profile 
and a return is required for crew survival. 


Ambient Light Any surrounding light source (existing lighting conditions). This could be a 
combination of natural lighting (e.g., sunlight, moonlight) and any artificial 
light source provided. For example, in an office there would be ambient light 
sources of both the natural sunlight and the fluorescent lights above (general 


office lighting). 

Analysis A verification method utilizing techniques and tools, such as math models, prior 
test data, simulations, analytical assessments, etc. Analysis may be used in lieu 
of, or in addition to, other methods to ensure compliance to specification 
requirements. The selected techniques may include, but not be limited to, task 
analysis, engineering analysis, statistics and qualitative analysis, computer and 
hardware simulations, and analog modeling. Analysis may be used when it can 
be determined that rigorous and accurate analysis is possible, test is not cost 
effective, and verification by inspection is not adequate. 


To provide a visual, tactile, or audible indication. 


Approach Ellipsoid | A 4x 2x2 km ellipsoid, centered at the ISS center of mass, with the long axis 
aligned with the V-Bar. 


Approach Initiation | The approach initiation is the first rendezvous maneuver during a nominal 
approach that is targeted to bring the vehicle inside the ISS approach ellipsoid 
(AE). 


Ascent The period of time from initial motion away from the launch pad until orbit 
insertion during a nominal flight or ascent abort initiation during an abort. 


Ascent Abort An abort performed during ascent, where the crewed spacecraft is separated 
from the launch vehicle without the capability to achieve the desired orbit. The 
crew is safely returned to a landing site in a portion of the spacecraft nominally 
used for entry and landing/touchdown. 


Automated Automatic (as opposed to human) control of a system or operation. 


Autonomous Ability of a space system to perform operations independent from any ground- 
| based systems. This includes no communication with, or real-time support 
from, mission control or other ground systems. 
procedure and careful return to a known, safe state. 

Breakout Any action that interrupts the nominally planned free flight operations that are 
intended to place the spacecraft outside of a threatening location to the 
cooperative vehicle. This may be an automated or manually executed action. 
For the ISS, the area within which a vehicle poses a threat to ISS is called the 
Approach Ellipse. 
health of its crew, and that must be launched and/or returned. 
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Catastrophic Event | An event resulting in the death or permanent disability of a ground closeout or 
flight crewmember, or an event resulting in the unplanned loss/destruction of a 
major element of the CTS or ISS during the mission that could potentially result 
in the death or permanent disability of a flight crewmember. 

Catastrophic A condition that could result in the death or permanent disability of a ground 

Hazard closeout or flight crewmember, or in the unplanned loss/destruction of a major 
element of the CTS during the mission that could potentially result in the death 
or permanent disability of a flight crewmember. 


Command Directive to a processor or system to perform a particular action or function. 


Communications Communication coverage is defined as successful link availability for nominal 
Coverage ascent and entry trajectories. 


Communications A communication link is established, whereas the received commands and 

Link voice from the CVCC to the spacecraft and the transmitted health and status 
data, crew health and medical related data, voice, telemetry, and transmitted 
launch vehicle and spacecraft engineering data are received. 

Consumable Resource that is consumed in the course of conducting a given mission. 
Examples include propellant, power, habitability items (e.g., gaseous oxygen), 
and crew supplies. 


Continental U.S. An airport within the continental United States capable of accommodating 
Airport executive jet aircraft similar to the Gulfstream series aircraft. 


Contingency Provisioning for an event or circumstance that is possible but cannot be 
predicted with certainty. 


Contingency CSCS is declared when the spacecraft crew takes shelter on the ISS because the 
Spacecraft Crew spacecraft has been determined to be unsafe for reentry. In this case, a rescue 
Support (CSCS) mission is required to return the spacecraft crew safely. 


Crew Any human onboard the spacecraft after the hatch is closed for flight or onboard 
the spacecraft during flight. 


Crew The collection of all space-based and ground-based systems (encompassing 

Transportation hardware and software) used to conduct space missions or support activity in 

System (CTS) space, including, but not limited to, the integrated space vehicle, space-based 
communication and navigation systems, launch systems, and mission/launch 
control. 

Critical Decision Those technical decisions related to design, development, manufacturing, 
ground, or flight operations that may impact human safety or mission success, 
as measured by defined criteria. 


event or abort. 
catastrophic event or an abort. 


Critical Hazard A condition that may cause a severe injury or occupational illness. 


Critical Software Any software component whose behavior or performance could lead to a 
catastrophic event or abort. This includes the flight software, as well as ground- 
control software. 


Critical Software/Firmware that resides in a safety-critical system that is a potential 
Software/Firmware | hazard cause or contributor, supports a hazard control or mitigation, controls 
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a 
potential hazard and/or 2) failures which lead to a hazardous condition. 

Critical (sub)System | A (sub)system is assessed as critical if loss of overall (sub)system function, or 
improper performance of a (sub)system function, could result in a catastrophic 
event or abort. 

CTS Certification CTS certification is the documented authorization granted by the NASA 
Associate Administrator that allows the use of the CTS within its prescribed 
parameters for its defined reference missions. CTS certification is obtained 
prior to the first crewed flight (for flight elements) or operational use (for other 
systems). 


CTS Element One component part of the overall Crew Transportation System. For example, 
the spacecraft is an element of the CTS. 


Deconditioned “Deconditioned” defines a space crewmember whose physiological capabilities, 
including musculoskeletal, cardiopulmonary, and neurovestibular, have 
deteriorated as a result of exposure to micro-gravity and the space environment. 
It results in degraded crewmember performance for nominal and off-nominal 
mission tasks. 

Definitive Medical An inpatient medical care facility capable of comprehensive diagnosis and 

Care treatment of a crewmember's injuries or illness without outside assistance— 
capable of care of Category I, II, and HI trauma patients. Usually a Level I 
trauma center, as defined by the American College of Surgeons. 

Demonstration A method of verification that consists of a qualitative determination of the 
properties of a test article. This qualitative determination is made through 
observation, with or without special test equipment or instrumentation, which 
verifies characteristics, such as human engineering features, services, access 
features, and transportability. Human-in-the-loop demonstration is performed 
for complex interfaces or operations that are difficult to verify through 
modeling analysis, such as physical accommodation for crew ingress and 
egress. Demonstration requirements are normally implemented within a test 
plan, operations plan, or test procedure. 

Docking Mating of two independently operating spacecraft or other systems in space 
using independent control of the two vehicles' flight paths and attitudes during 
contact and capture. Docking begins at the time of initial contact of the 
vehicles' docking mechanisms and concludes when full rigidization of the 
interface is achieved. 

Downrange Abort A geographical region of the North Atlantic Ocean to be avoided for water 

Exclusion Zone landings during ascent aborts for ISS missions due to rough seas and cold water 
temperatures. The region is depicted in Figure B-1. The St. John’s abort 
landing area includes the waters within 200 nmi range to St John’s International 
Airport (47° 37’ N, 52° 45’ W). The Shannon abort landing area includes the 
waters within 200 nmi range to Shannon International Airport (52° 42’ N, 8° 
55’ W). Note: The northern and southern bounds of the DAEZ in the ISS 
Mission DAEZ figure are notional, as these bounds are limited only by steering 
and cross-range performance along the ascent trajectory and are not formally 
constrained. 
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Downrange Abort 
Exclusion Zone 
Figure 


St. John's Abort 
Landing Area 


Latitude (deg) 


60 -S0 -40 
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Figure B-1 Ascent Downrange Abort Exclusion Zone 
An unexpected event or events during a mission that requires immediate action 
to keep the crew alive or serious injury from occurring. 

Emergency Egress Capability for a crew to exit the vehicle and leave the hazardous situation or 
catastrophic event within the specified time. Flight crew emergency egress can 
be unassisted or assisted by ground personnel. 

Emergency Systems (ground or flight) that exist solely to prevent loss of life in the presence 

Equipment and of imminent catastrophic conditions. Examples include fire suppression 

Systems systems and extinguishers, emergency breathing devices, Personal Protective 
Equipment (PPE) and crew escape systems. Emergency systems are not 
considered a leg of failure tolerance for the nominal, operational equipment and 


systems, and do not serve as a design control to prevent the occurrence of a 
catastrophic condition. 


Services required to provide the crewmembers with immediate medical care to 
Services prevent loss of life or aggravated physical or psychological conditions. 
The planned landing time for the entire mission, including the nominal pre- 
flight agreed to docked mission duration. 


Entry The period of time that begins with the final commitment to enter the 
atmosphere from orbit or from an ascent abort, and ending when the velocity of 
the spacecraft is zero relative to the landing surface. 


Entry Interface The point in the entry phase where the spacecraft contacts the atmosphere 
(typically at a geodetic altitude of 400,000 feet), resulting in increased heating 
to the thermal protection system and remainder of the spacecraft exterior 
surfaces. 

External Launch Conditions outside the CTS provider's control, such as range weather 

Constraint constraints or faults with range or ISS assets, or weather constraints affecting 
abort rescue forces capabilities. Range weather examples include ability to 
visually monitor the initial phases of the launch for range safety, etc. Non- 
weather range constraints include range safety radar and telemetry systems 
availability, flight termination systems readiness, clearance of air, land, sea, etc. 


Failure Inability of a system, subsystem, component, or part to perform its required 
function within specified limits. 
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Failure Tolerance The ability to sustain a certain number of failures and still retain capability. A 
component, subsystem, or system that cannot sustain at least one failure is not 
considered to be failure tolerant. 

An undesired system state and/or the immediate cause of failure (e.g., 
maladjustment, misalignment, defect, or other). The definition of the term 
“fault” envelopes the word “failure,” since faults include other undesired 
events, such as software anomalies and operational anomalies. Faults at a lower 
level could lead to failures at the higher subsystem or system level. 

Flight Configuration | The arrangement, orientation and operational state of system elements and 
cargo, vehicle cabin layout, flight software mode, and crew complement, 
clothing and equipment in the applicable mission or ground phase necessary in 
verification to evaluate the attributes called out in the requirement. 


the spacecraft, launch vehicle, launch abort system, and crew worn equipment. 
supporting the integrated space vehicle from liftoff until landing. 


Flight Phase A particular phase or timeframe during a mission is referred to as a flight phase. 
The term “all flight phases” is defined as the following flight phases: pre- 
launch, ascent, onorbit free-flight, docked operations, deorbit/entry, landing, 
and post-landing. 


Flight Description of a test-article used in verifications in which the attributes under 
Representative evaluation are equivalent to the flight article. 


Example: Human-in-the-loop tests for spacecraft egress must use an equivalent 
cabin layout, seats and restraints, and hatch configuration and masses. However, 
the propulsion system does not need to be functional, as it is not under 
evaluation. 


Flight Rules Established redline limits for critical flight parameters. Each has pre-planned 
troubleshooting procedures with pre-approved decisions for expected 
troubleshooting results. 


Flight Systems Any equipment, system, subsystem or component that is part of the integrated 
space system. 


Flight Termination | An emergency action taken by range safety when a vehicle violates established 
safety criteria for the protection of life and property. This action circumvents 
the vehicles’ normal control modes and ends its powered and/or controlled 
flight. 


Free Flight Onorbit operations that occur when the spacecraft is not in contact with any part 
Operations of the ISS. 


Ground Crew Operations personnel that assist the flight crew in entering the spacecraft, 
closing the hatch, performing leak checks, and working on the integrated space 
vehicle at the pad during launch operations. 


Ground Hardware All components and systems that reside on the ground in support of the mission, 
including the Commercial Vehicle Control Center, launch pad, ground support 
equipment, recovery equipment, facilities, and communications, network, and 
tracking equipment. 
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Ground Processing | The work required to prepare the launch vehicle and spacecraft for mission 
from final assembly/integration/test through launch and resumes after landing 
for recovery of crew and cargo. 

Ground Support Any non-flight equipment, system(s), ground system(s), or devices specifically 

Equipment designed and developed for a direct physical or functional interface with flight 
hardware to support the execution of ground production or processing. The 
following are not considered to be GSE: 

e Tools designed for general use and not specifically for use on flight 
hardware. 
e Ground Support Systems that interface with GSE Facilities. 


Habitable The environment that is necessary to sustain the life of the crew and to allow 
(inaaae the crew to perform their functions in an efficient manner. 
Hazard A state or a set of conditions, internal or external to a system, that has the 
potential to cause harm. 
Health and Status Data, including emergency, caution, and warning data, that can be analyzed or 


Data monitored describing the ability of the system or system components to meet 
their performance requirements. 


Human Error Either an action that is not intended or desired by the human or a failure on the 
part of the human to perform a prescribed action within specified limits of 
accuracy, sequence, or time that fails to produce the expected result and has led 
or has the potential to lead to an unwanted consequence. 


Human Error A systematic approach used to evaluate human actions, identify potential 


Analysis (HEA) human error, model human performance, and qualitatively characterize how 
human error affects a system. HEA provides an evaluation of human actions 
and error in an effort to generate system improvements that reduce the 
frequency of error and minimize the negative effects on the system. HEA is the 
first step in Human Risk Assessment and is often referred to as qualitative 
Human Risk Assessment. 


Human-in-the-Loop | Human-in-the-loop evaluations involve having human subjects, which include 

Evaluation NASA crewmembers as a subset of the test subject population, perform 
identified tasks in a representative mockup, prototype, engineering, or flight 
unit. The fidelity of mockups used for human-in-the-loop evaluations may 
range from low-fidelity, minimal representation, to high-fidelity, complete 
physical and/or functional representation, relevant to the evaluation. Ideally, 
the fidelity of human-in-the-loop mockups and tests increases as designs mature 
for more comprehensive evaluations. Further information on human-in-the- 
loop evaluations throughout system design can be found in JSC 65995 CHSIP. 

Human-System The process of integrating human operations into the system design through 

Integration analysis, testing, and modeling of human performance, interface 
controls/displays, and human-automation interaction to improve safety, 
efficiency, and mission success. 

Ill or Injured Refers to a crewmember whose physiological and/or psychological well-being 
and health has deteriorated as a result of an illness (e.g., appendicitis) or injury 
(e.g., trauma, toxic exposure) and requires medical capabilities exceeding those 
available on the ISS and transportation to ground-based definitive medical care. 
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Ill or injured crewmember performance for nominal and off-nominal mission 
tasks will be degraded. 


Inspection A method of verification that determines conformance to requirements by the 
use of standard quality control methods to ensure compliance by review of 
drawings and data. This method is used wherever documents or data can be 
visually used to verify the physical characteristics of the product instead of the 
performance of the product. 

Integrated All operations starting at 90 minutes prior to the ISS Approach Initiation and 

Operations lasting until the vehicle leaves the ISS Approach Ellipsoid on a non-return 
trajectory. 

Vehicle for the phase of flight from post lift-off until spacecraft separation. 
approach, touchdown, and coming to rest. 

Landing Site Supported Landing Sites: A fully supported site on a Continental U.S. land 
mass or waters directly extending from the coast with CTS recovery forces on 
station at the time of landing. The landing site zone extends through nominally 
expected dispersions from the landing site point. 

Designated Primary Landing Site — A supported landing site-intended for 
landing at the time of spacecraft undock. 

Alternate Landing Site — A supported landing site to which the spacecraft 
landing can be diverted in the event the deorbit burn is delayed. 

Unsupported Landing Sites: 

Emergency Landing — Any unsupported site (land or water) arrived at due to 
critical failures that force immediate return and preclude landing at a designated 
primary or alternate landing sites. 

Launch Commit Established redline limits for critical launch parameters. Each has pre-planned 

Criteria troubleshooting procedures with pre-approved decisions for expected 
troubleshooting results. 

Launch Opportunity | The period of time during which the relative position of the launch site, the ISS 
orbital plane, and ISS phase angle permit the launch vehicle to insert the 
spacecraft into a rendezvous trajectory with the ISS (northerly launches only 
due to range constraints). The ISS is in-plane with the Eastern Range 
approximately every 23 hours and 36 minutes. 

Launch Probability | The probability that the system will successfully complete a scheduled launch 
event. The launch opportunity will be considered scheduled at 24 hours prior to 
the opening of the launch window. 


Launch Vehicle The vehicle that contains the propulsion system necessary to deliver the energy 
required to insert the spacecraft into orbit. 


Life-Cycle The totality of a program or project extending from formulation through 
implementation, encompassing the elements of design, development, 
verification, production, operation, maintenance, support, and disposal. 


Death or permanently debilitating injury to one or more crewmembers. 
Loss of Mission Loss of, or the inability to complete enough of, the primary mission objectives, 
such that a repeat mission must be flown. 
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Maintenance The function of keeping items or equipment in, or restoring them to, a specified 
operational condition. It includes servicing, test, inspection, 
adjustment/alignment, removal, replacement, access, assembly/disassembly, 
lubrication, operation, decontamination, installation, fault location, calibration, 
condition determination, repair, modification, overhaul, rebuilding, and 
reclamation. 

Manual Control The crew's ability to bypass automation in order to exert direct control over a 
space system or operation. For control of a spacecraft's flight path, manual 
control is the ability for the crew to affect any flight path within the capability 
of the flight control system. Similarly, for control of a spacecraft's attitude, 
manual control is the ability for the crew to affect any attitude within the 
capability of the flight/attitude control system. 

MCC-H Mission e MCC-H has authority to make final decisions regarding spacecraft 

Authority operations, including but not limited to Go/No-Go decisions and safety of 

flight and crew(s). 
Beginning with either ISS integrated operations, or 30 minutes before the 
first required ISS configuration or crew activity in support of the spacecraft 
on rendezvous (e.g., ISS attitude maneuver, appendage configuration, 
USOS GPS configuration), whichever comes first. 
Ending with either the end of ISS integrated operations, or when ISS is not 
required to maintain its configuration (e.g., ISS attitude, USOS GPS 
configuration, or appendages in a configuration) to support the spacecraft, 
whichever comes later. 
Applies anytime the spacecraft free-drift trajectory, including dispersions, 
is predicted to enter the ISS AE within the next 24 hours. 
The mission begins with entry of the crew into the spacecraft, includes delivery 
of the crew to/from ISS, and ends with successful delivery of the crew to NASA 
after landing. 
Item or function that must retain its operational capability to assure no mission 
failure (i.e., for mission success). 

Operations All persons supporting ground operations or flight operations functions of the 

Personnel CTS. Examples of these personnel are listed below: 

Persons responsible for the production, assembly/integration/test, validation, 
and maintenance of flight hardware, production facilities, launch site facilities, 
operations facilities, or ground support equipment (GSE). Persons involved 
with supporting or managing the launch countdown, crew training, or mission 
during flight. Persons involved in post-flight recovery. 


This flight phase starts just after final orbit insertion and ends at the completion 
of the first deorbit burn. 
To take precedence over system control functions. 


An abort performed where the crewed spacecraft is separated from the launch 
vehicle while the launch vehicle remains on the launch pad. As a result, the 
crewed spacecraft is safely transported to an area which is not susceptible to the 
dangers associated with the hazardous environment at the launch pad. 

A non-fatal occupational injury or illness resulting in permanent impairment 
through loss of, or compromised use of, a critical part of the body, to include 
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major limbs (e.g., arm, leg), critical sensory organs (e.g., eye), critical life- 
supporting organs (e.g., heart, lungs, brain), and/or body parts controlling major 
motor functions (e.g., spine, neck). Therefore, permanent disability includes a 
non-fatal injury or occupational illness that permanently incapacitates a person 
to the extent that he or she cannot be rehabilitated to achieve gainful 
employment in their trained occupation and results in a medical discharge from 
duties or civilian equivalent. 

Portable Fire A system comprised of one or more portable handheld fire extinguishers and 

Suppression System | access ports. These access ports allow the user to discharge fire suppressant 
into enclosed areas with potential ignition sources. See also 3.10.12.2 Use of 
Hazardous Chemicals. 


Post-Landing The mission phase beginning with the actual landing event when the vehicle has 
no horizontal or vertical motion relative to the surface and ending when the last 
crewmember is loaded on the aircraft for return to JSC. 


Proximity The flight phase including all times during which the vehicle is in free flight 

Operations beginning just prior to Approach Initiation (AI) execution and ending when the 
vehicle leaves the Approach Ellipsoid (AE). 

Quiescent Docked The state of the CTS spacecraft while it is docked to the ISS with hatches open 

Operations and ISS services, as called out in SSP 50808, connected and operational. From 
this state, the vehicle can support immediate ingress and transition into safe 
haven in the case of an emergency. 


Recovery The process of proceeding to a designated nominal landing site, and retrieving 
crew, flight crew equipment, cargo, and payloads after a planned nominal 
landing. 


Reliability The probability that a system of hardware, software, and human elements will 
function as intended over a specified period of time under specified 
environmental conditions. 


Rendezvous The flight phase of executing a series of onorbit maneuvers to move the 
spacecraft into the proximity of its target. This phase starts with orbit insertion 
and ends just prior to the approach initiation. 

Safe Haven A functional association of capabilities and environments that is initiated and 
activated in the event of a potentially life-threatening anomaly and allows 
human survival until rescue, the event ends, or repair can be affected. It is a 
location at a safe distance from or closed off from the life-threatening anomaly. 


Safety The absence from those conditions that can cause death, injury, occupational 
illness, damage to or loss of equipment or property, or damage to the 
environment. 


Safety Critical A condition, event, operation, process, function, equipment or system 
(including software and firmware) with potential for personnel injury or loss, 
or with potential for loss or damage to vehicles, equipment or facilities, loss or 
excessive degradation of the function of critical equipment, or which is 
necessary to control a hazard. 


The process of locating the crew, proceeding to their position, and providing 
assistance. 

Computer instructions or data stored electronically. Systems software includes 
the operating system and all the utilities that enable the computer to function. 
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Applications software includes programs that do real work for users, such as 
word processors, spreadsheets, data management systems, and analysis tools. 
Software can be Commercial Off-The-Shelf (COTS), contractor developed, 
Government furnished, or combinations thereof. 


Spacecraft All system elements that are occupied by the crew during the space mission and 
provide life support functions for the crew. The crewed element includes all the 
subsystems that provide life support functions for the crew. 


Space System The collection of all space-based and ground-based systems (encompassing 
hardware and software) used to conduct space missions or support activity in 
space, including, but not limited to, the integrated space vehicle, space-based 
communication and navigation systems, launch systems, and mission/launch 
control. 


Stowage The accommodation of physical items in a safe and secure manner in the 
spacecraft. This does not imply that resources other than physical 
accommodations (e.g., power, thermal, etc.) are supplied. 


Subsystem A secondary or subordinate system within a system (such as the spacecraft) that 
performs a specific function or functions. Examples include electrical power, 
guidance and navigation, attitude control, telemetry, thermal control, 
propulsion, structures subsystems. A subsystem may consist of several 
components (hardware and software) and may include interconnection items 


such as cables or tubing and the support structure to which they are mounted. 


System The aggregate of the ground segment, flight segment, and workforce required 
for crew rescue and crew transport. 


Task Analysis Task analysis is an iterative human-centered design process through which user 
tasks are identified and analyzed. It involves 1) the identification of the tasks 
and subtasks involved in a process or system, and 2) analysis of those tasks 
(e.g., who performs them, what equipment is used, under what conditions, the 
priority of the task, dependence on other tasks). The focus is on the human and 
how they perform the task, rather than the system. Results can help determine 
the hardware or software that should be developed/used for a particular task, the 
ideal allocation of tasks to humans vs. automation, and the criticality of tasks, 
which drive design decisions. Further information on task analysis can be 
found in JSC 65995 CHSIP, Section 4.1. 

A method of verification in which technical means, such as the use of special 
equipment, instrumentation, simulation techniques, and the application of 
established principles and procedures, are used for the evaluation of 
components, subsystems, and systems to determine compliance with 
requirements. Test will be selected as the primary method when analytical 
techniques do not produce adequate results; failure modes exist, which could 
compromise personnel safety, adversely affect flight systems or payload 
operation, or result in a loss of mission objectives. The analysis of data derived 
from tests is an integral part of the test program and should not be confused 
with analysis as defined above. Tests will be used to determine quantitative 
compliance to requirements and produce quantitative results. 


Time-Critical Cargo | Cargo that requires late stowage pre-launch (within 24 hours of launch) and 
early removal post-landing (within | hour of crew egress). 
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Transport Launch of crew and cargo to and return from the ISS. 


Validation Proof that the product accomplishes the intended purpose. May be determined 
by a combination of test, analysis, and demonstration. 


Verification Proof of compliance with a requirement or specifications based on a 
combination of test, analysis, demonstration, and inspection. 


Commercial Crew Program 


International Space Station Program Page 190 of 295 


ISS Crew Transportation and 
Services Requirements Document 


Appendix C: TBC/TBD/TBR/TBS Tables 


Issue 


None 


None 
None 


Section Details 
None 
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Appendix D: Crew Physical Dimension and Mass Design Data 


Table D-1: Vehicle Design Critical Anthropometric Dimensions 


: a : : Minimal Clothing 
ee ae | Minimal Clothing 
esign Concern ritical Dimension Min (cm [in af exten al (cm [in.)) 


Maximum vertical Stature, Standing* 
V | | 2 
ertical seating clearance | Sitting Height 78.2 (30.8) 101.3 (39.9) 


Placement of panels to be | Eye Height, Sitting* 

within line-of-sight 66.5 (26.2) 88.9 (35.0) 
Top of seatback A ial Height, Sitting® 

a ee 


Placement of objects Thigh Clearance, Sitting 
which may be over lap 
(panels, control wheel, 13.0 (5.1) 20.1 (7.9) 
etc.) 
Height of panels in front of | Knee Height, Sitting 
subject 
45.5 (17.9) 63.5 (25.0) 


— scr 


Width of seat pan Hip Breadth, Sitting! 
31.5 (12.4) 46.5 (18.3) 


L 
ength of seat pan aren Popliteal Length, 42.2 (16.6) 57.2 (22.5) 
g 
Placement of panels in Buttock- Knee Length, 
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Rudder pedal design, foot | Foot Length, Sitting 
clearance 21.6 (8.5) 30.5 (12.0) 


Placement of control Thumbtip Reach, Sitting 


1 For seated measurements, the largest female hip breadth is larger than the largest male hip breadth, 
and the smallest male hip breadth is smaller than the smallest female hip breadth; therefore, male data 
are used for the Min dimension, and female data are used for the Max dimension. 


@ DELETED 

3 DELETED 

4 For measurements that include the length of the spine, add 3% of stature to allow for spinal 
elongation due to micro-gravity exposure. 

° For measurements that include the length of the spine in seated posture, add 6% of seated height to 
allow for spinal elongation due to micro-gravity exposure. 


The minimum and maximum critical dimension values are representative of the NASA astronaut corps 
and based on the 2009 anthropometric selection criteria for astronaut applicants as documented in JSC 
64548 Anthropometric and Strength Selection Criteria for Astronaut Applicants. The critical 
anthropometric dimensions provide measurements commonly deemed as most important to consider for 
vehicle and suit design based on past experience. For example, sitting height is a critical dimension for 
seat design because it ensures head clearance, while biacromial breadth is critical to proper design of 
restraint straps. Vehicle design must also consider crew uniform and use critical dimensions for crew 
wearing minimal clothing, unpressurized suit, or pressurized suit, as appropriate. The CTS suit 
minimum and maximum critical dimensions are needed for verification of vehicle design to 
accommodate the suited crewmember. Refer to the JSC 65995 CHSIP section 4.5 for additional 
information and guidance on using and evaluating critical anthropometric dimensions in vehicle design. 
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Table D-2: Suit Design Critical Anthropometric Dimensions 
Design Concern Critical Dimension Minimal Clothing 


Min (cm [in.]) | Max (cm [in.]) 


Maximum vertical | Stature, Standing 
T izi Vertical Trunk Di 
orso Sizing ertical Trunk Diameter 55.9 (22.0 75.9 (29.9 


) (29.9) 
665 (262) | 958877) 
Knee height mid-patella 39.6 (15.6) 57.9 (22.8) 
23.6(9.3) | 39.4 (15.5) 
19.175) __[_30.2(11.9) 


Neck Head length 
eck ring and ead lengt 17.3 (6.8) 21.6 (8.5) 


helmet sizing 

Maximum Thigh circumference 
circumference of 47.8 (18.8) 71.9 (28.3) 
upper leg 

Maximum Biceps circumference 


circumference of | flexed 22.9 (9.0) 40.4 (15.9) 
upper arm 


Chest circumference 75.7 (29.8) 118.6 (46.7 
175: (45.3) | 1618 (63.7 
) 


Functional arm Inter-elbow distance 


( 
101.3 (39.9) 


Waist depth 15.0 (5.9) 30.0 (11.8 
Hip breadth’ 29.7 (11.7) 40.6 (16.0) 


Wrist-to-wall distance 54.6 (21.5) 77.7 (30.6) 


'For standing measurements, the largest female hip breadth is larger than the largest male 
hip breadth; therefore, female data are used for both the Minimum and the Maximum 
dimension. 
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Table D-3: Whole Body Mass 


Crewmember Body Mass (kg [Ib]) 
42.64 (94) 78.93 (174) 
110.22 (243) 146.51 (323) 


“The crewmember body mass for "Suited" includes 36.29 kg 
(80 Ib) for the pressure garment and does not 
include crew survival gear or EVA gear. 


Data are projected forward to 2015. 


Body mass data is important for various systems. Most importantly, body mass properties must be used 
for propulsion calculations and ensuring the structural integrity of human system interfaces. Propulsion 
and system dynamic calculations depend on accurate data for the full range of crewmember mass to size 
the propulsion system and design proper vehicle dynamic controls. Vehicle systems with human system 
interfaces are to be designed such that they will not be damaged after being subjected to the forces that a 
crewmember can impart on that interface during acceleration. As an example, body support systems 
(e.g., seats, brackets, and restraints) are to accommodate forces exerted by a suited crewmember, under 
all anticipated acceleration and gravity environments. The mass data provided is for unsuited crew and 
includes body mass, center of mass, and moment of inertia for both whole-body and body-segments. 


Table D-4: Whole Body Mass for Multiple Crew, Unsuited 


Per 
Crewmember 
Crew Mean Std. Dev 95th % tile 80th % tile Weight 
Number (kg(Ibs)) (kg(Ibs)) (kg(Ibs)) (kg(Ibs)) (kg(Ibs)) 
1 xX Xx 110.2 (243.1)* xX Xx 
2 154.7 (340.3) | 16.1 (35.4) 181.1 (398.4) 168.3 (370.3) 84.2 (185.1) 
3 232.0 (510.4) | 19.7 (43.3) 264.4 (581.6) 248.6 (546.9) 82.9 (182.3) 
4 309.1 (680.0) | 22.7 (49.9) 346.4 (762.2) 328.2 (722.0) 82.1 (180.5) 
5 386.8 (850.9) | 25.5 (56.2) 428.8 (943.3) 408.3 (898.3) 81.7 (179.7) 
6 463.9 (1020.6) | 27.8 (61.2) | 509.6 (1121.2) | 487.3 (1072.1) 81.2 (178.7) 


*99" percentile value 


It is unreasonable to design for a worst-case scenario of all crewmembers having a maximum body 
mass. Applied to a multi-crew configuration, the limits raise to unacceptably high numbers; 440.2 kg 
(972.4 lbs) for a 4 crew configuration and 661.2 kg (1458.6 lbs) for a 6 crew configuration. This 
number is far too high to use as a design requirement for crew weight, and illogical since there is a very 
low probability that four 99" percentile male crewmembers will fly at any given time. A Monte Carlo 
simulation was performed to derive the above table. The Monte Carlo simulation generated a new group 
weight population by randomly selecting groups of individuals from an existing population over a 


certain number of iterations. 
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Table D-5: Body Segment Mass of a Crewmember, Unsuited 


2.99 (6.59) 
0.49 (1.08) 1.39 (3.07) 
3 Thorax 11.35 (25.02) | 34.33 (75.69) 
4 Abdomen 2.14 (4.72) 3.25 (7.16) 
5 Pelvis 5.62 (12.4) | 16.46 (36.29) 
0.91 (2.0) 2.74 (6.04) 
0.59 (1.29) 1.86 (4.09) 
0.24 (0.52) 0.66 (1.45) 
2.22 (4.9) 4.79 (10.55 
3.86 (8.12) 8.48 (18.69 
1.94 (4.28) 5.11 (11.27) 
0.44 (0.98) 1.26 (2.77) 
19.11 (42.13) | 54.05 (119.15) 
5.91 (13.03) | 13.26 (29.24) 


5.03 (11.08) 


Hl 


_— 


fi 
_ 
— | — 


Forearm plus hand 


(748) 0.82 (1.81) 2.51 (5.54) 


‘if 


Data are projected forward to 2015. 
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Whole Body Center of Mass: Assuming that the human flesh was homogeneous, it can also be 
assumed that the center of volume is at the center of mass location. McConville et al. (1980) and Young 
et al. (1983) provided ranges for the location of the center of volume for the male and female, 
respectively, in each study. Because regression equations were not given for the center of volume, the 
range values from the McConville et al. (1980) and Young et al. (1983) studies were used here. Specific 
values for the locations of the center of mass with respect to the anatomical axes were taken from each 
study to form the range; specifically, the upper range was set by the male upper range, and the lower 
range was set by the female lower range. 


Table D-6: Whole Body Center of Mass Location 


The axes in the figure above represent the anatomical 
axes. 


[Dimension [Min fem,in)) [Max fem.(in) 
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Appendix E: Crewmember Strength Data 


Strength refers to a person’s ability to generate force. Applying the following strength requirements will 
result in a minimum and maximum applied crew load to be used for operational and hardware design. 
The minimum load pertains to operational strength that accommodates the weakest person while the 
maximum load represents the force the hardware must be able to withstand without failure. It is 
important to note that these requirements apply to intentional forces applied by the crewmember. 
Durability is applicable to structural integrity of hardware due to non-intentional crew forces which is 
handled through the structural design process defined in JSC 65829, Loads and Structural Dynamics 
Requirements for Spaceflight Hardware. 


Max Crew Loads - Vehicle components and equipment are to be designed to withstand large forces 
exerted by a strong crewmember during nominal hardware operation, without breaking or sustaining 
damage that would deem the hardware inoperable. Humans may also exert high forces when operating 
controls in emergency situations, such as attempting to open a hatch for emergency egress. The resulting 
possible damage to equipment could make it impossible to respond safely to the emergency. To avoid 
overdesign, a task analysis is performed to identify which interfaces must tolerate maximum crew 
operational loads. This includes identifying critical hardware that may be inadvertently used as a 
mobility aid or restraint. The data provided in the tables are for unsuited, suited-unpressurized, and 
suited-pressurized conditions. Data was derived from a collection of journal articles associated with 
human strength data. 


Minimum Crew Loads - The design must allow for all crewmembers to perform any of the requested 
tasks efficiently and effectively, thus ensuring task and/or mission success. The data provided is for 
unsuited, suited-unpressurized, and suited-pressurized conditions. A human-centered design process is 
to be used when implementing operational strength limits. Analysis of expected crew operations, 
activities, and tasks is to drive the design of human-machine interfaces. The analysis should evaluate 
and define activities/tasks in terms of criticality and required postures. 


For this purpose tasks that involve the possibility of a single failure causing loss of life or vehicle have a 
definition of Criticality 1 Operations in the following tables. Tasks involving LOM alone have a 
Criticality 2 Operations. The values in the criticality 1 and 2 columns also include the decrement 
factor(s) to reflect the deconditioning effects on crewmembers after an extended duration of mission. All 
other tasks fall into the “Other Operations” category. It is important to note that the designer should be 
careful not to implement multiple safety factors. For example, NASA-STD-5017 torque/force margin 
requirements (4.10.0) levy an extra safety factor on the applied torque/force to a given mechanism. 
Implementing this requirement along with the already built in safety factor (i.e., criticality) in the 
strength tables results in an overly conservative design. 


Data was derived from a collection of journal articles associated with human strength data. In addition, 
other references were used, such as the MIL-STD-1472F and the Occupational and Biomechanics 
textbook (Chaffin, D. B., Occupation Biomechanics, Second Edition, John Wiley & Sons, Inc., 1991), to 
set a standard for very specific strength data such as lifting strength. 
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Table E-1: Crewmember Strength - Unsuited 


Type Of Strength 


One Handed Pulls 


Seated Horizontal 
Pull In? 

[Subject in a seated 
position pulls 
towards his/her 
body. 
Unilateral/Isometric 
measurement 
Seated Vertical Pull 
Down? 

[Subject in a seated 
position pulls 
downwards. 
Unilateral/Isometric 
measurement 
Seated Vertical Pull 
Up? 

[Sitting erect with 
feet apart, dominant 
hand grasping 
D-ring located 
directly to the front 
above the floor, 
pulling upward 
while keeping 
shoulder squares & 
other arm in lap 
Standing Vertical 
Pull Up 

[Standing erect with 
feet apart, dominant 
hand grasping 
underside of D-ring 
located directly to 
the side above 
standing surface, 
pulling upward 
while keeping 
shoulders square 
and other arm 
relaxed at side 
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Minimum Crew Operation Loads 
(N(Lbf)) 


Crit 1 Crit 2 


Other 
Operations | Operations | Operations 


One Handed Pulls 


125 (28) 


147 (33) (101) 
165 (37) 
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Maximum 
Crew 


Operational 
Loads 
(N(Lbf)) 


449 (101 
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Table E-1: Crewmember Strength - Unsuited 


Type Of Strength 


Two Handed Pulls 
q 
s 
' 


Standing Vertical 
Pull Down # 
[Standing erect 
with feet apart, with 
both hands holding 
handle located 
above shoulders, 
pulling downward 
Standing Pull in? 
[Standing erect 
with feet apart, with 
both hands holding 
handle located in 
front , pulling 
inward towards 


Standing Vertical 
Pull Up ri 
[Standing with feet 
apart with a slight 
bend at the knees 
and waist, grasping 
a handle with both 
hands located 
directly in front and 
pulling upward 
Seated Vertical Pull 
Up? 

[Sitting erect with 
feet apart, grasping 
both sides of 
handle located 
directly to the front 
above the floor, 
pulling upward 
using arms and 
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Minimum Crew Operation Loads Maximum 
(N(Lbf)) Crew 
Operational 
Crit 1 Crit 2 Other Loads 
Operations | Operations | Operations | (N(Lbf)) 
Two Handed Pulls 
707 (159) 
391 (88) 
1437 (323) 
1188 (267) 
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Type Of Strength 


ee Operations 


One Handed Push One Handed Push 


Seated Horizontal 
Push Out® 

[Subject in a 
seated position 
pushing away from 
his/her body. 
Unilateral/lsometric 
measurement 
Seated Vertical 
Push Up? 

[Subject in a 
seated position 
pushing upward in 
a vertical direction. 
Unilateral/Isometric 


Two Handed Push Two Handed Push 


Standing Vertical 
Push Down? 
[Standing with feet 
apart with a slight 
bend at the knees 
and waist, grasping 
a handle with both 
hands located 
directly in front and 
pushing 
downwards 
Standing Horizontal 
Push Out! 
[Standing erect with 
feet apart, with both 
hands holding 
handle located in 
front, pushing out 
away from bod 
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Table E-1: Crewmember Strength - Unsuited 
(Page 3 of 7) 


(N(Lbf)) 
Crit 1 


+ 


89 (20) 116 (26) 


” 
(i 
67 (15) 85 (19) 


102 (23) 


i- 


62 (14) 


Minimum Crew Operation Loads 


Operations | Operations 


218 (49) 


165 (37) 


Maximum 
Crew 
Operational 
Loads 
(N(Lbf)) 


525 (118) 


596 (134) 
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Type Of Strength 


Standing Vertical 
Push Up? 
[Standing erect with 
feet apart, grasping 
from below, both 
sides of handle 
located directly in 
front above 
standing surface. 
Pushing upwards 
using arms and 
shoulders] 


Arm Pull? 


[Subject pulls 
handle forward and 


Arm Push? 


[Subject pushes 
handle forward and 


[Subject pushes 
and pulls handle in 
a various directions 
as shown by the 
figures 

Arm Down? 
[Subject pushes 
and pulls handle in 
a various directions 
as shown by the 
figures 

Arm In? 

[Subject moves 
handle mediall 

Arm Out® 

[Subject moves 
handle laterally] 
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Minimum Crew Operation Loads 
(N(Lbf)) 


Crit 1 Crit 2 Other 
Operations | Operations | Operations 


Two Handed Push 


98 (22) 
Ar 
) 


187 (42) 


) 


22 (5 31 (7) 


Maximum 
Crew 
Operational 
Loads 
(N(Lbf)) 


1094 (246) 


249 (56) 


222 (50) 


107 (24) 


116 (26) 


m 
5 
5 


(24) 
8 (22) 
40 (9) 
8 (13) 
8 (13) 
36 (8) 


) 
22 (5) 31 (7) 


Fn | we | om 


98 (22) 


76 (17) 
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Table E-1: Crewmember Strength - Unsuited 
(Page 5 of 7) 


Minimum Crew Operation Loads Maximum 


Type Of Strength (N(Lbf)) oon 


Operational 
Crit 1 Crit 2 Loads 
Operations | Operations | Operations | (N(Lbf)) 


eg J 


Lifting Strength? 
[Standing with 
feet apart with a 
slight bend at the 
knees and waist, 


grasping a 
handle with both 


hands located 
directly in front 
and pulling 
upward using 
primarily arms 
and shoulders, 


Flexion* 

[Subject moves 
forearm ina 
sagittal plane 
around the elbow 


Extension? 
[Subject moves 
forearm ina 
sagittal plane 
around the elbow 
joint] 


Type Of Strength 


36 (8) 49 (1 Ae ee 93(21) | 1228 (276) 


36 (8) 347 (78) 


27 (6) 36 (8) 67 (15) 249 (56) 
Minimum Crew Operational Loads Maximum 
(Ncm(in-Ib)) Crew 


Operational 
Crit 1 Other Loads 
Operations gee tees Operations | (N:m(in-lh)) 


Pronation” 


[Subject rotates 
hands and 


Supination? 
[Subject rotates 
hands and 


Commercial Crew Program 
International Space Station Program 


1.1(10) | 2.1(18.4) | 11.3 (100) 
2.1(18.4) | 11.3 (100) 
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Table E-1: Crewmember Strength - Unsuited 
(Page 6 of 7) 


Minimum Crew Operation Loads Maximum 
Type Of Strength (N(Lbf)) Crew 
Operational 
Crit 1 Crit 2 Other Loads 
Operations | Operations | Operations | (N(Lbf)) 


Wrist & Hand Wrist & Hand 


Wrist Flexion? 
[Subject bends - 
wrist in a palmar vA 
direction 31 (7) 40 (9) 76 (17) 209 (47) 
Wrist Extension? 
[Subject bends 
the wrist ina 
irecti ) 18 (4) 36 (8) 85 (19) 


[Subject 
squeezes 
together the 
thumb and finger] 
13 (3) 18 (4) 200 (45) 
Grasp! 
[Subject 
maintains an 
eccentric tight 
hold of an object i 347 (78) 463 (104) | 694(156) | 1219 (274) 
Grip! 
[Subject 
maintains a 
concentric tight 
hold of an object 
t 49 (11) 67 (15) 102 (23) 783 (176) 
Leg 


Hip Flexion® 
[Subject moves 
leg in the sagittal 
plane around the 
hip joint toward 


the front of the 
116 (26) 645 (145) 


Hip Extension? 

[Subject moves 

upper and lower 

leg in a sagittal 

plane around the 

hip joint 476 (107) 658 (148) 
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Table E-1: Crewmember Strength - Unsuited 
(Page 7 of 7) 


Minimum wt eee | Loads 


“opine 1 Crit 2 Other 
once] in| A ool — 


Leg wae ot 
[Subject moves 
leg in a sagittal 
plane around the 
hip joint toward 
the back of the 
618 (139) | 827(186) | 1552 (349) | 2584 (581) 


a Of Strength 


Knee Flexion’ 
[Subject moves 
lower leg ina 
sagittal plane 
around the knee 
53 (12) 71 (16) 138 (31) 325 (73) 
Knee Extension’ 
[Subject moves 
lower leg ina 
sagittal plane 
around the knee 
142 (32) 191 (43) 383 (86) 783 (176) 


Post-space flight maximal measured strength decrement. 
Post-space flight estimated strength decrement. Range is 0%-26%. Average 
estimated is 20%. Based on max EDOMP Data. Not all motions were measured on EDOMP. 


2 


Note: To convert forces to torque for elbow, hip, knee, or wrist exertions, use the longest or shortest moment arm based on 
the anthropometric values provided in Table D-1 as appropriate. 
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Table E-2: Crewmember Strength - Suited Unpressurized 
(Page 1 of 6) 


Minimum Crew Operational Loads- N (Ibf) Maximum 


Crew 
Type of Strength Operational 
Crit 1 Crit 2 Other Loads- N 
Operations Operations Operations (Ibf) 
One Handed . One Handed Pulls 


Seated Horizontal 

Pull In? 

[Subject in a seated 

position pulls 

towards his/her 

body. 

Unilateral/Isometric 

measurement] 103(23 193(43 314(71 
Seated Vertical Pull 

Down" 

[Subject in a seated . 

position pulls 

downwards. 

Unilateral/Isometric 

measurement] 8(20) 116(26) 218(49) 411(92) 


Seated Vertical Pull 
Up? 

[Sitting erect with 
feet apart, dominant 
hand grasping D- 
ring located directly 
to the front above 
the floor, pulling 
upward while 
keeping shoulder 
squares & other 
arm in lap] 34(8) 47(11) 88(20) 529(119) 
Standing Vertical 
Pull Up 

[Standing erect 
with feet apart, 
dominant hand 
grasping underside 
of D-ring located 
directly to the side 
above standing 
surface, pulling 
upward while 
keeping shoulders 
square and other 
arm relaxed at side] 37(8) 50(11 93(21) 508(114) 
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Table E-2: Crewmember Strength - Suited Unpressurized 
(Page 2 of 6) 


Minimum Crew Operational Loads- N (Ibf) Maximum 


Crew 
Type of Strength Operation 
Crit 1 Crit 2 Other al Loads- 

Operations Operations Operations N (Ibf) 


Two Handed Pulls Two Handed Pulls 


Standing Vertical Q ,\ 
Pull Down? 4 
: 

[Standing erect 
with feet apart, with 
both hands holding 
handle located 
above shoulders, 

ulling downward] 97(22 127(29) 240(54) 495(111) 
Standing Pull in“ rome 

———— 

[Standing erect : 
with feet apart, with 
both hands holding 
handle located in 
front , pulling 
inward towards 
body] 41(9) 56(13) 103(23) 274(62) 


Standing Vertical + 
Pull Up 4 \ 
[Standing with feet t 
apart with a slight 
bend at the knees 
and waist, grasping 
a handle with both 
hands located 
directly in front and 
ulling upward] 62(14) 81(18 153(34) 1006(226 
Seated Vertical Pull ‘ 
Up? q) 
[Sitting erect with 
feet apart, grasping q 
both sides of handle 
located directly to 
the front above the 
floor, pulling 
upward using arms 
and shoulders] 65(15 88(20) 165(37 832(187 
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Table E-2: Crewmember Strength - Suited Unpressurized 
(Page 3 of 6) 


Minimum Crew Operational Loads- N (Ibf) Maximum 


Crew 
Type of Strength Operation 
Crit 1 Crit 2 Other al Loads- 
Operations Operations Operations N (Ibf) 
One Handed Push One Handed Push 
Seated Horizontal 
Push Out? 


[Subject in a seated 
position pushing 
away from his/her 
body. 
Unilateral/Isometric 
measurement] 


Seated Vertical 

Push Up? : 

[Subject in a seated . 

position pushing 

upward in a vertical 

direction. 

Unilateral/Isometric 

— "ae 7(1 —— ean 60(13) 112(25) 196(44) 


| TwoHandedPush sd Handed Push — | ss TwoHandedPush i (tst—‘—sSCisY Handed Push 


Standing Vertical 

Push Down? 

[Standing with feet 

apart with a slight 

bend at the knees 

and waist, grasping 

a handle with both 

hands located 

directly in front and 

pushing 

downwards] 71(16) 93(21 178(40 368(8 
Standing 

Horizontal Push 

Out! 4. 

[Standing erect 

with feet apart, with 

both hands holding 

handle located in 

front, pushing out 

away from body] 43(10) 60(13) 116(26) 417(94) 
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Table E-2: Crewmember Strength - Suited Unpressurized 


Type of Strength 


Two Handed Push 
Standing Vertical 


#, 
Push Up? 1 iV 


[Standing erect 

with feet apart, 
grasping from 
below, both sides of 
handle located 
directly in front 
above standing 
surface. Pushing 
upwards using arms 
and shoulders] 


(Page 4 of 6) 


Minimum Crew Operational Loads- N (Ibf) 


Crit 1 Crit 2 Other 
Operations Operations Operations 


Two Handed Push 


53(12) 69(15) 131(29) 


CCT-REQ-1130 
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Maximum 


Operation 


Arm 


Arm Pull” 


[Subject pulls 


handle forward and ; = 
backward] > = 


Arm Push~ 


[Subject pushes 
handle forward and 
backward] 

Arm Up* 


[Subject moves 


handle up] \ 
Arm Down" \ 


[Subject moves 
handle down] 
Arm In- 


[Subject moves 
handle medially] 

SS : 
Arm Out" 


[Subject moves 
handle laterally] 
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31(7) 41(9) 75( 


17) 
28(6) 
13(3) Le lan | 
9) 


15(4) 22(5) 41( 


155(35) 
75(17) 


15(4) 22(5 41(9) 


9(2) 
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(Page 5 of 6) 
Minimum Crew Operational Loads- N (Ibf) gril, 
rew 
Type of Strength Operation 
Crit 1 Crit 2 Other al Loads- 
Operations Operations Operations N (Ibf) 
Lifting 
Lifting Strength” 
[Standing with feet SS 
apart with a slight 
bend at the knees t 
and waist, grasping 
a handle with both 
hands located 
directly in front and 
pulling upward 
using primarily 
arms and shoulders, 
and legs] 25(6 860(193) 
Elbow Po bow 
Flexion™ s 
[Subject moves 
forearm in a sagittal 
plane around the 
elbow joint] 9 (2) 13 (3) 25 (6) 243 (55) 
Extension™ 
[Subject moves 
forearm in a sagittal 
plane around the 
elbow joint] 19 (4) 25 (6) 47 (11) 174 (39) 
Minimum Crew Operational Loads Maximum 
Type Of Strength N-m(in-Ib)) Crew 
Operational 
Crit 1 Crit 2 Other Loads (N:m(in- 
Operations | Operations | Operations Ih)) 
Wrist & Hand Wrist & Hand 
Pronation? 
[Subject rotates 
hands and 0.7 (6.4) 0.9 (8.5) 1.8 (16) 13.1 (116) 
forearms 
mediall 
Supination? 
[Subject rotates 
hands and 0.7 (6.4) 0.9 (8.5) 1.8 (16) 13.1 (116) 
forearms 
laterall 
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Table E-2: Crewmember Strength - Suited Unpressurized 


(Page 6 of 6) 
Wrist & Hand Wrist & Hand 


Wrist Flexion™ ; 

[Subject bends 

wrist in a palmar 

direction] 22 (5) 28 (6) 53 (12) 146 (33) 
Wrist Extension™ 

[Subject bends the 

wrist in a dorsal 

direction] 60 (13) 


Pinch 


[Subject squeezes 
together the thumb 
and finger] 


aximum 
Crew 
Operation 
Other 
Operations 


Grasp” 

[Subject maintains 

an eccentric tight P 

hold of an object] 324 (73) 486 (109) 

Grp 

[Subject maintains 

a concentric ight 

hold of an object] 392 (88 


Hip Fiexton™ 
[Subject moves leg a 
in the sagittal plane FP 
around the hip joint bs . 
toward the front of ; ; 

81 (18) 109 (25 
[Subject moves 
lower leg in a 
sagittal plane = 
around the knee : 
joint, decreasing 7 
the angle between 
the upper and lower 

37 (8) 97 (22) 


[Subject moves 

lower leg ina 

sagittal plane 

around the knee 

joint, increasing the 

angle between the 

upper and lower 

leg] 

1. Post space flight maxima measured strength decrement. 

2. Post space flight estimated strength decrement. Range is 0% - 47%. Average estmated is 33%. Based on 
CRY Requirements Document. 

3. Suit decrement not measured directly, but estimated based on functional strengthtesting of other 


movements. 


Note: To convert forces to torque for elbow, hip, knee, or wrist exertions, use the longest or shortest moment arm based on 
the anthropometric values provided in Table D-1 as appropriate. 
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Table E-3: Crewmember Strength - Suited Pressurized 
(Page 1 of 8) 


Minimum Crew Operation Loads Maximum 
(N(Lbf)) Crew 
Operational 
Crit 2 Loads 
Operations | Operations | Operations (N(Lbf)) 


One Handed Pulls One Handed Pulls 


Seated 
Horizontal Pull 
In? 

[Subject in a 
seated position 
pulls towards 
his/her body. 
Unilateral/ 
Isometric 
measurement 


Type Of Strength 


Seated Vertical 

Pull Down? 

[Subject in a 

seated position 

pulls downwards. 

Unilateral/Isomet 3(14) 3(19) 156(35) 294(66) 
ric measurement 


One Handed Pulls One Handed Pulls 


Seated Vertical 

Pull Up? 
[Sitting erect with 
feet apart, 

dominant hand 

grasping D-ring 

located directly to 

the front above 

the floor, pulling 

upward while 

keeping shoulder 

squares & other 25(6) 34(8) 63(14) 378(85) 
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Table E-3: Crewmember Strength - Suited Pressurized 


(P 


Minimum Crew Operation Loads 
Type Of Strength (N(Lbf)) 


eet Op 


One Handed Pulls 


Standing Vertical 
Pull Up 
[Standing erect 
with feet apart, 
dominant hand 
grasping 
underside of 
D-ring located 
directly to the 
side above 
standing surface, 
pulling upward 
while keeping 
shoulders square 
and other arm 
relaxed at side 


Two Handed Pulls 


Standing Vertical 
Pull Down 2 
[Standing erect 
with feet apart, 
with both hands 
holding handle 
located above 
shoulders, pulling 


[Standing erect 
with feet apart, 
with both hands 
holding handle 
located in front, 
pulling inward 
towards bod 


Commercial Crew Program 
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age 2 of 8) 


Maximum 
Crew 
Operational 
Loads 
(N(Lbf)) 


Crit 1 
erations 


Crit 2 Other 
Operations | Operations 


One Handed Pulls 


36(8) 67(15) 363(8 


| ss TwoHanded Pulls si Handed Pulls 


, 

: 
69(16) 1(21) 172(3 354(80) 
FT [I 
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Table E-3: Crewmember Strength - Suited Pressurized 
(Page 3 of 8) 


Minimum Crew Operation Loads Maximum 
Type Of Strength (N(Lbf)) Crew 


Operational 
Crit 1 Crit 2 Other Loads 
Operations | Operations | Operations | (N(Lbf)) 


Two Handed Pulls Two Handed Pulls 


Standing Vertical 
Pull Up* 
[Standing with 
feet apart with a 
slight bend at the 
knees and waist, 
grasping a 
handle with both 
hands located 
directly in front 
and pulling 45(10) 58(13) 109(25) 719(162) 
upward] 


Seated Vertical 
Pull Up? » 
[Sitting erect with 
feet apart, 
grasping both 
sides of handle 
located directly to 
the front above 
the floor, pulling 
upward using 
47(11) 63(14) 118(27) 594(134) 


One Handed Push One Handed Push 


Horizontal Push 

Out? 

[Subject in a ; . 

seated position 

pushing away 

from his/her 

body. 

Unilateral/Isomet 45(10) 58(13) 109(25) 218(49) 
ric measurement 
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Table E-3: Crewmember Strength - Suited Pressurized 
(Page 4 of 8) 


Minimum Crew Operation Loads Maximum 
Type Of Strength (N(Lbf)) Craw 
Operational 
Crit 1 Crit 2 Other Loads 
Operations | Operations | Operations | (N(Lbf)) 


One Handed Push One Handed Push 


Seated Vertical 
Push Up? 
[Subject in a 
seated position 
pushing upward 
in a vertical 
direction. 
Unilateral/lsomet 
ric measurement 


Two Handed Push Two Handed Push 


Standing Vertical 
Push Down? 4 . 
[Standing with \ t 
feet apart with a 
slight bend at the 
knees and waist, 
grasping a 
handle with both 
hands located 
directly in front 
and so 67(15) 127(29) 263(59) 
downwards] 
é 


Standing 

Horizontal Push 

Out' 

[Standing erect 

with feet apart, 

with both hands 

holding handle 

located in front, 

pushing out away 31(7) 43(10) 83(19) 298(67) 


from body] 


34(8) 43(10) 80(18) 140(32) 
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Table E-3: Crewmember Strength - Suited Pressurized 
(Page 5 of 8) 


Minimum Crew Operation Loads Maximum 
Type Of Strength (N(LE)) Crew 
Operational 
Crit 1 Crit 2 Other Loads 
Operations | Operations | Operations | (N(Lbf)) 


| TwoHandedPush si Handed Push Two Handed Push 


Snag vee Vertical 

Push Up? f t 
[Standing erect \ 
with feet apart, 

grasping from 

below, both sides 

of handle located 

directly in front 

above standing 

surface. Pushing 

upwards usin 

say | beet " 9(11) 4(21) 547(123) 


== Pull 
[Subject pulls 
handle forward 22(5) 29(7) 
. 54 (12) 125 (28) 


[Subject pushes ; 
handle forward 20(5) 27(6) 
49 (11) 111 (25) 


[Subject moves 
handle up] 


Arm Down 
[Subject moves 
handle down pam || 


Arm In 
handle mediall 29(7) 49 (11) 
Arm Out* 
[Subject moves 
handle laterally] 7(2) 9(2) 
18 (4) 38 (9) 
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Table E-3: Crewmember Strength - Suited Pressurized 


Type Of Strength 


Crit 1 Crit 2 Other 
Operations | Operations | Operations 


Lifting 


Lifting 


(Page 6 of 8) 


Minimum Crew Operation Loads 
(N(Lbf)) 


Lifting Strength? _ 
[Standing with 
feet apart with a 
slight bend at the 
knees and waist, 
grasping a 
handle with both 
hands located 
directly in front 
and pulling 
upward using 
primarily arms 
and shoulders, 


[Subject moves 
forearm ina 
sagittal plane 


[Subject moves 
forearm ina 
sagittal plane 
around the elbow 
joint] 


Elbow 


Maximum 
Crew 
Operational 
Loads 
(N(Lbf)) 


47(11) 


614(138) 
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Type Of Strength 


Qcnu(in-Ih)) 
Crit 2 


Operations 


Crit 1 


Operations 


Minimum Crew Operational Loads 


Other 
Operations | (N:m(in-lb)) 


Maximum 
Crew 
Operational 

Loads 


Wrist & Hand 


Pronation? 
[Subject rotates 
hands and 
forearms 
medially] 
Supination? 
[Subject rotates 
hands and 
forearms 
laterall 


Commercial Crew Program 
International Space Station Program 


1.2 (11) 


Wrist & Hand 


2.3 (20) 


13 (115) 


1.2 (11) 


2.3 (20) 


13 (115) 
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Table E-3: Crewmember Strength - Suited Pressurized 


Type Of Strength 


(Page 7 of 8) 


Minimum Crew Operation Loads 
(N(Lbf)) 


Crit 1 Crit 2 Other 
Operations | Operations | Operations 


Wrist & Hand 


Wrist & Hand 


Wrist Flexion? ? 
[Subject bends 
wrist in a palmar 


Extension** 
[Subject bends 
the wrist ina 
dorsal direction 
Pinch 

[Subject 
squeezes 
together the 


thumb and finger] 


Grasp " 

[Subject 
maintains an 
eccentric tight 
hold of an object 
Grip 

[Subject 
maintains a 
concentric tight 
hold of an object 
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174 (39) 
25 (6) 
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Table E-3: Crewmember Strength - Suited Pressurized 


(Page 8 of 8) 


Minimum oy ee Loads 


Type of Strength | Type of Strength | Strength ee 


Operational 
Crit 1 Crit 2 Other Loads 
Operations a — (N(Lbf)) 


Hip Flexion Rese _—— 
[Subject moves 
leg in the sagittal 
plane around the 
hip joint toward 


the front of the 


58 (13) 78 (18) 


[Subject moves 
leg in a sagittal 
plane around the 
hip joint toward 


the back of the 
127 (29) 


[Subject lee 
a weight away 
from them using 
their legs] 


414 (93) 


[Subject moves 
lower leg in a 
sagittal plane 
around the knee 


[Subject moves 
lower leg ina 
sagittal plane 


around the knee 


joint] 71 (16) 96 (22) 


145 (33) 323 (73) 


lee 


192 (43) 392 (88) 


1. Post space flight maximal measured strength decrement. 


2. Post space flight estimated strength decrement. Range is 0% - 47%. Average estimated is 33%. Based on 


CRY Requirements Document. 


3. Suit decrement not measured directly, but estimated based on functional strength testing of other 


movements. 
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Note: To convert forces to torque for elbow, hip, knee, or wrist exertions, use the longest or shortest moment arm based on 
the anthropometric values provided in Table D-1 as appropriate. 
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Appendix F: Metabolic Loads 


F.1 Metabolic Loads 


In order to allow calculation of vehicle environmental control system capacity, it is necessary to know 
expected crewmember metabolic loads, which will be affected by the magnitude of work being 
performed. Three tables are provided with metabolic rates for unsuited crew, IVA suited crew, and post- 
landing suited crew. 


Table F-1 provides estimates of metabolically generated heat (column 5), water (column 6), and CO2 
(column 9) for an individual unsuited crewmember, standard mission day, without exercise. This table 
was populated with physiologically measured parameters as well as 41-Node man simulations. These are 
expected crew induced loads based on the assumptions and conditions stated in the legend, and therefore 
will be altered if any of these variables change. Total heat output from a single crewmember is the sum 
of sensible (dry) heat and wet heat outputs. The sensible (dry) heat component includes only direct 
radiation and convection of heat from a crewmember. Total wet heat includes two components: 1) latent 
heat, including heat in water vapor, which is exhaled, and that of which evaporates directly from the 
skin, and 2) sweat run-off, which includes heat in sweat which leaves the body in the form of liquid. 


Since exercise will not be mandated on such a short mission, the peak metabolic load was derived from 
terrestrial metabolic rate data for moderate activity and the expected crewmember response to the 
dynamic phases of flight. Due to expected g-forces, vibration, and crewmember neuro-sensory response, 
the dynamic flight phases were assumed to produce the highest amount of metabolic loads induced on 
the system by the crewmembers outside of exercise. As a reference, the longest duration of dynamic 
flight during a mission is currently 26 minutes, which occurs during re-entry for the Shuttle. It is 
recommended that the system has the capability of handling the highest peak metabolic load for duration 
of 30 minutes to ensure crew safety. 


Table F-1: Individual Crewmember Metabolic Loads - Standard Day, Unsuited 


Activity | Duration | Total Heat | Sensible | Wet Heat Water O2 COz2 
(hr) Output (dry) Heat Output Vapor Consumption | Output 
Rate (BTU/ Output (BTU/ Output Rate Rate 
crew-hr) Rate crew-hr) Rate (lom/crew-hr) (lorm/ 
(BTU/crew aa wel an 
-hr) 


a 
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Rationale and Input Assumptions for 
Table F-1: 


!) 


2) 


3) 


a 


5) 


6) 
7) 


8) 
9) 


Male - Male because more astronauts are male than female, and with a crew of males, metabolic 
rates will encompass the loads generated by that of a mixed crew or a crew of all females. 

82 kg Weight - Current astronaut corps average weight for males is 78 kg and projected male 
astronaut corps average weight for 2015 is 82 kg. Additional calculations of metabolic 
expenditure were also made assuming different masses of crewmembers, and the output/loads 
change in a corresponding linear fashion; however the 82 kg assumed mass is felt to be most 
representative for sizing ECLSS systems. 

Thermo-Neutral Environment - Constant Temp = 70 °F (21 deg C) and Constant Dew Point = 
50 °F (10 deg C), a team of Physiologist, Engineers and Scientist agreed on environmental 
conditions for the model input. 

Astronaut Corps Fitness Level - max VO2 = 48 mL/kg/min +/- 6 mL/kg/min, this value was 
quantified from actual VO2 max testing data and applied to the model for oxygen consumption 
during exercise as well as converted into BTU/hr for a model input. 

Respiratory quotient/Respiratory Exchange Ratio (RER) - Historically a range of 0.87 - 0.92 has 
been found for CO2 production. This quotient or ratio can rise to as high as I during intense 
exercise sessions. A team of Physiologists, Engineers and Scientists agreed on the RER for the 
model input taking into account that this is a critical element of crew health, especially while 
living in close quarters, and considering the expected level of activity. 

Exercise is not required for the very short duration ISS missions 

Vehicle Pressure - Described to the team by ECLSS as being 10.2 psia for planned standard 
operating pressure in LEO and likely for transit phases, so this value was used as an input to the 
modeling. While the Spacecraft minimum required pressure is 14.7 psi, the values provided in 
Table F-1 are applicable. 

0 g - There is only microgravity in space so this was used as a model input. 

Clothing - There are several thermodynamic models for the human system under certain 
conditions and stresses and these models predict different outcomes based on the amount of 
clothing. The model input for clothing is short sleeved t-shirt and shorts and the insulation and 
convection properties that apply to that clothing type were used in the modeling. 


10) Sleeping metabolic rate of 300 BTU/hr was agreed upon by a team of Physiologists, Engineers 


and Scientists and is within the range of historical data during non-wakeful activity. 


11) Nominal metabolic rate of 474 BTU/hr was agreed upon by a team of Physiologists, Engineers 


and Scientists and is within the range of historical data for typical Intravehicular Activity level. 


12) The 41-Node man model has been used and incorporated into NASA testing, verifications, 


validations since the 1960s and from different data analysis has shown to be accurate within 5% 
when similar constants and variables are chosen. 
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Table F-2 provides the metabolic loads for individual suited [VA crewmember. 


Table F-2: Suited IVA Crew Metabolic Loads Table 


Sensible Water O CO 
Total (dry) Wet Heat | Vapor : , 7 
Consumptio | Output 
Heat Heat Output Output 
ea n Rate Rate 
Activity Output Output (Btu/crew | Rate 
(lom/crew- (lom/crew 
(Btu/crew | Rate -hr) (lom/crew hr) “hr) 
-hr) (Btu/crew -hr) 
-hr) 


0.0671 | 0.0484 0.0612 
0.0816 | 0.0725 0.0918 
0.0912 | 0.0887 0.1122 


Launch/Landin eo 0.221 0.145 0.183 
g 


Table F-3 provides the metabolic rates for nominal post-landing, suited crewmember. 


Table F-3: Nominal Post-Landing Metabolic Rates (Suited) 


Total Heat | Sensible (dry) Wet heat Water Vapor O2 CO2 
Output Rate | Heat Output Output Output Rate | Consumption | Consumption 
Rate Rate Rate 


ae oe 
350 275 0.072 0.0567 0.0717 


400 320 ce ae] 0.0768 0.0647 0.0819 


The off-nominal post-landing metabolic rates for suit doffing is estimated to average 650 BTU/hr and 
have peak load of 1500 BTU/hr for up to 15 minutes. These estimates are based on analysis performed 
for Orion suit doffing as documented in IL-HSIR-72 Table E1-4. 
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Appendix G: Food and Potable Water 


Table G-1: Potable Water Physiochemical Limits 


Aesthetic: 

Taste 3 TIN 
Odor E TON 
Turbidity I NTU 
Color, True iS PCU 
Free & Dissolved Gas' 5 % 
Acidity (pH) 4.5-9.0 N/A 
Chemical: 

Ammonia’ I mg/L 
Antimony” 2 mg/L 
Arsenic 0.01 mg/L 
Barium? 10 mg/L 
Cadmiun? 0.022 mg/L 
Chloride 250 mg/L 
Chlorine 4 mg/L 
Chromium 0.23 mg/L 
Copper 1.0 mg/L 
Cyanide 0.2 mg/L 
Fluoride 2 mg/L 
Tron 0.3 mg/L 
Lead® 0.009 mg/L 
Manganese? 0.3 mg/L 
Mercury 0.002 mg/L 
Nickel’ 0.3 mg/L 
Nitrate (as Nitrogen, NO3-N) 10 mg/L 
Nitrite (as Nitrogen, NO2-N) 1.0 mg/L 
Potassium 340 mg/L 
Selenium 0.01 mg/L 
Silver? 0.4 mg/L 
Sulfate 250 mg/L 
Total Dissolved Solids 500 mg/L 
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Total Iodine® 0.2 mg/L 
Zinc? 2.0 mg/L 
Total Organic Carbon’? 5 mg/L 
Acetone? 15 mg/L 
Alkylamines (di)? 0.3 mg/L 
Alkylamines (mono)? 2 mg/L 
Alkylamines (tri)? 0.4 mg/L 
Benzene? 0.07 mg/L 
Caprolactum? 100 mg/L 
Chloroforn? 6.5 mg/L 
Di(2-ethylhexyl) phthalate? 20 mg/L 
Di-n-butyl phthalate? 40 mg/L 
Dichloromethane? IS mg/L 
Ethylene glyco? 4 mg/L 
Formaldehyde? 12 mg/L 
Formate? 2,500 mg/L 
2-Mercaptobenzothiazole* 30 mg/L 
Methanol2 40 mg/L 
Methylethylketone2 54 mg/L 
Phenol2 4 mg/L 
Propylene glycol2 1700 mg/L 
n-Phenyl-beta-naphthylamine? 260 mg/L 
Semi-volatile Organic Compounds( EPA Method 625 ) EPA MCL?*? | mg/L 
Volatile Organic Compounds listed in EPA 524.2, Rev. 4 | EPA MCL*? | mg/L 


CCT-REQ-1130 
Revision: E-1 


NOTES: (TTN = threshold taste number, TON = threshold odor number, NTU = nephelometric turbidity 


unit, PCU = platinum-cobalt unit) 


1. Free gas at vehicle atmospheric pressure and 98.6 °F (37 deg C), dissolved gas saturated at vehicle 


atmospheric pressure and 98.6 °F (37 deg C). 


2. 1,000-day SWEG in JSC 63414, Spacecraft Water Exposure Guidelines (SWEG). 
3. JSC-28379 “Medical Effects of Iodine: Proceedings of NASA/JSC Conference”’, March 1998; and SSP 
41000 “System Specification for the International Space Station”, Table LXX, August 2014. 
4. Environmental Protection Agency (EPA) Maximum Contamination Level (MCL). 

5. Ifa compound has both a SWEG and EPA MCL, the SWEG value takes precedence. 
6. Garcia, H.D. et al., Establishment of Exposure Guidelines for Lead in Spacecraft Drinking Water. Aviat 


Space Envrion Med 2014; 85(7):715-720. 
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Appendix H: Acceleration Limits Acceleration Coordinate System 


Physiological Acceleration Physiological Reaction 
Nomenclature Nomenclature 


rut 


Anatomical axes x, y, z 


Angular Acceleration %, %,, a, Angular Reaction Rx, Ry, Rz 


Figure H-1: Acceleration Environment Coordinate System 
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Table H-1: Direction and Inertial Resultant of Body Acceleration 


a. Direction of Acceleration 


Linear Motion Aircraft Standard Acceleration Description 
Forward +ax Forward acceleration 
Backward -ax Backward acceleration 
Upward +az Headward acceleration 
Downward -az Footward acceleration 
To the Right -ay Rightward acceleration 
To the Left +ay Leftward acceleration 


b. Inertial Resultant of Body Acceleration 


Linear : ; a Physiologic ze 

Motion Physiologic Descriptive Sinndard Vernacular Descriptive 
Transverse anterior-posterior G, r 

Forward prone G,chest-to backG +Gx Eyeballs-in 
Transverse posterior-anterior G, 

Backward supine G, back to chest G -Gx Eyeballs-out 

Upward Positive G +G; Eyeballs-down 

Downward Negative G -G, Eyeballs-up 

To the right Lateral G +Gy Eyeballs-left 

To the left Lateral G -Gy Eyeballs-right 


Note: G expresses inertial resultant to whole-body acceleration in multiples of the magnitude of the 
acceleration of gravity. Acceleration of gravity, g=9.80665 m/s” 
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Sustained accelerations, linear or rotational, are events with a duration of greater than 0.5 seconds. 
Transient accelerations, linear or rotational, are events with a duration of less than or equal to 0.5 
seconds. 


+GX_ Eyeballs In 


100 


Limit for Abort or Emergency Entry 
=— =Limit for Launch to Mission Destination 
= = =Limit for Earth Return 


Acceleration (g's) 
ray 


0.1 1 10 100 1000 
Duration (sec) 


Figure H-2: +Gx Sustained Translational Acceleration Limits 


Data for Figure H-2 


Duration (sec) 0.5 10 30 50 90 120 150 10000 
Roti. | Accel 's) 4 [10 [8 [63 |/5 |/43 |4 4 
Duration (sec) 0.5 5 300 
TN. “cael eS) 19 [16 |75 
Duration (sec) 0.5 120 | 300 | 1200 
EMete> T Acél, (G'S) 38. «(88 [75 [5 
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-Gx Eyeballs Out 
100 + 


Limit for Abort or Emergency Entry 


=— =Limit for Launch to Mission Destination 
= = =Limit for Return to Earth 


Acceleration (g's) 
3 


~ 


sustained 


0.1 


Figure H-3: -Gx Sustained Translational Acceleration Limits 


10 
Duration (sec) 


Data for Figure H-3 


100 


1000 
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Duration (sec) 0.5 10 30 50 90 100 | 100 | 10000 
Rewin: Accel (Ge) 13.5 [8 6 47 |405/4 [4 |4 
Duration (sec) 0.5 5 120 400 
Tone) Aéesl,. (G'S) ry) 15 | 6 4 
Duration (sec) 0.5 120 | 300 1200 
Emerg. | Accel. (G's) 29 77. [62 | 43 
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1000 


+Gz Eyeballs Down 
100 2 
Limit for Abort or Emergency Entry 
=—= =Limit for Launch to Mission Destination 
= = =Limit for Return to Earth 
10 
oO ==" = 
A=] imi Te a 
c 
2 
s 
o 
oO rr a 
8 a 
=. 
<= 1 S 
sustained 
0.5 
0.1 
0.1 10 100 
Duration (sec) 


Figure H-4: +G, Sustained Translational Acceleration Limits 


Data for Figure H-4 
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Duration (sec) 0.5 15 30 50 | 80 100 | 120 | 10000 
Bee “heel (Gs) 2 125 71 08 1068106 1/05 |05 
Duration (sec) 0.5 5 1200 
Paunch “heel aS) 83 | 64 4 
Duration (sec) 0.5 120 1200 
EMere.. - |-Aveel. ao) 17 1/6 3.8 


Commercial Crew Program 


International Space Station Program 


Page 229 of 295 


ISS Crew Transportation and 


Services Requirements Document 


Acceleration (g's) 


(ae 


0.5 


0.1 


-Gz Eyeballs Up 


10 Lee 


Limi 
— =Limi 
= = =Limi 


for Abort or Emergency Entry 
for Launch to Mission Destination 
for Return to Earth 


0 
Duration (sec) 


Figure H-5: -G; Sustained Translational Acceleration Limits 


Data for Figure H-5 


Duration (sec) 0.5 | 10 30 50 80 100 120 10000 
Rete Acces) 2 (18 1/12 [08 [055/05 [05 |05 
Duration (sec) 0.5 | 5 60 1200 
Pe Accel (G's) 6 [38 /22 [1 
Emerg. | Duration (sec) 0.5 | 120 | 1200 
Accel. (G's) 6.5 | 2.3 | 1.6 
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+/-Gy 


10 


sustained 


Acceleration (g's) 


=——— Limit for Abort or Emergency E 
=— =Limit for Launch to Mission Destination 
= = =Limit for Ret 


urn to Earth 


ntry 


at 


0.1 
0.1 


10 
Duration (sec) 


100 


1000 


Figure H-6: +Gy Sustained Translational Acceleration Limits 
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Data for Figure H-6 


Duration (sec) 0.5 | 100 10000 
Reumn s Aceake (G'S) > 1 i 

Duration (sec) 0.5 | 1000 | 1000 
Faunce: "| Agecl (Gs) 7 | 9 2 

Duration (sec) 0.5 | 1000 | 1000 
Emer’. “| Aceel. (GS) 5 |2 2 
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Appendix I: Radiation 


1.1 Retinal Thermal Injury from Visible and Near Infrared Sources 


Requirements for limiting crew exposure to the electromagnetic spectrum from the ultraviolet (180 nm) 
to the far infrared (3,000 nm) are derived from the methodology given in the American Conference of 
Governmental Industrial Hygienists (ACGIH) standard, Threshold Limit Values (R) and Biological 
Exposure Indices®, Sections "Light and Near-Infrared Radiation" and "Ultraviolet Radiation." This 
methodology allows for the quantification of the relationship between source strength and acceptable 
exposure times for each of four potential injury pathways (retinal thermal injury caused by exposure to 
visible light, retinal photochemical injury caused by chronic exposure to blue-light, thermal injury to the 
ocular lens and cornea caused by infrared exposure, and exposure of the unprotected skin or eye to 
ultraviolet radiation). These limits do not apply to laser exposure. The numerical values used by the 
ACGIH are amended for use by NASA by the insertion of a factor of 0.2 in the source term of each 
calculation with the exception of ultraviolet exposure, which is not amended. This removes the 
excessive margin of safety imposed by the ACGIH on general populations. 


The system shall limit exposure of the crew to spectral radiance LA at wavelengths between 385 and 
1,400 nm such that: 


1400 5 
0.2>3,{2, R(A)Aa} s 
385 at 


where, LA is the source spectral radiance in W/(cm**srenm), R(A) is the Retinal Thermal Hazard 
Function given in Table I-1, where t is the viewing duration in seconds, and @ is the angular subtense of 
the source in radians. 


Table I-1: Blue-Light and Retinal Thermal Hazard Functions 


Function, B(A) Hazard Function, R(A) 
305-335 fon 
= as 
= as 
= CT Ee 
= CT Ee 
= ook 
= as 
atk Cs 
= as 
= 
= 
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Wavelength (nm) Blue-Light Hazard Retinal Thermal 
: Function, B(A) Hazard Function, R(A) 
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Function, B(A) Hazard Function, R(A) 


a8 
ake 
20 
28 
700-1050 fe ENT 
jloso-i4o0 


1.2 Small Source Visible Radiation Limits 


The system shall limit the spectral irradiance EA of the crew at wavelengths between 305 and 700 nm for 
visible-light sources subtending an angle less than 11 milliradians, such that: 


700 
0.25. {£,tB(AjA4} S10 mJ fom? for t <10's 


305 
or 
700 


0.2>° {2,344} s 1 wa fem? for t > 10's 
305 


where B(A) is the blue-light hazard function given in Table I-1. 


1.3 Large Source Visible Radiation Limits 
The system shall limit the exposure of the crew to spectral radiance LA at wavelengths between 305 and 
700 nm for visible light sources subtending an angle greater than or equal to 11 milliradians, such that: 


700 
0.25°{£,c8(A)Aa} <100 J /{em? sr) fort <10's 


305 
or 


700 
0.25°{2, BAA} < 107 Wflem?.sr) for t>10's 
305 


where B(A) is the blue-light hazard function given in Table I-1. 
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1.4 Thermal Injury from Infrared Radiation 


The system shall limit the spectral irradiance EA of the crew at wavelengths between 770 and 3,000 nm 
to 10 mW/cm” for exposure durations longer than 1,000 seconds, and for exposure durations less than 
1,000 seconds such that: 


3000 
0.2) {E,AA< 186°" Wem? 


770 


.Note: The Threshold Limit Values (TLVs) apply to an environment with an ambient temperature of 37 
°C, and can be increased by 0.8 mW/cm/? for every whole degree below 37 °C. 


1.5 Ultraviolet Exposure for Unprotected Eye or Skin 


The system shall limit the spectral irradiance EA of the crew at wavelengths between 180 and 400 nm 
weighted by the spectral effectiveness function SA (given in Table I-2) to: 


400 
SE, s,tda} =3 md fem in any 24 hr period 


1380 


A table of weighted spectral irradiances versus permissible exposure times is given in Table I-3 


Table I-2: UV Radiation Exposure TLV and Spectral Weighting Function 


= 250 
= 160 
2 100 
205 590 
210 400 
215 320 
220 250 
225 200 
230 160 
235 130 
240 100 
= 
= 
= 
a 
= 
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Relative Spectral 
Effectiveness, S; 


[aoe 
310 
1000 
325 | 
330 | 
35 , 
360 23810 
370 , 
375 59710 
385 | 


390 


roo 
1 


A 
o 
| 
6 
0 


400 
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Table I-3: Permissible Ultraviolet Exposures (200 - 400 NM) 


a 
15 min 
10 min 
Fn 
(min, 


10360 
sec 
05 ee 
0.1 see 
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Appendix J: 


Total Minimum 


Mass (kg) 


Total 
Volume 
(cc) be Provided 
40 cm x 26 
cm x 6cm 
(15.7 inch x 
10.2 inch x 
2.36 inch) 


Environmental 
Health Kit 


Food and 
Utensils 


2962 cc 
fixed 
+5876 cc 
/crew/day 
food 


1.69 kg 
fixed 
+1.52 kg 
/crew/day 
food 
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Dimensions to 
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Reference NASA-Provided Supplies 


Rationale 


NASA will provide an environmental 
health kit for environmental 
monitoring hardware. It is anticipated 
that the hardware in this kit will 
include, but not be limited to: grab 
sample containers, high-rate 
dosimeters, and water sampling 
hardware. The stowage for this kit is 
not provided by NASA and is not 
included in the mass and volume. 
NASA-provided food and utensils 
accounts for meals that would occur in 
all nominal and contingency scenarios 
(e.g. Delayed Rendezvous, Deorbit 
Waive-off). The crew’s food is based 
on: the trip to ISS, the return from 
ISS, and the contingency days 
(Docking delay of 24 hours, safe 
haven of 6 hours and deorbit waive off 
of a minimum of 24 hours) for 4 
crewmembers. The food system 
consists of a fixed mass for dining 
supplies (e.g. salt tablets and utensils) 
and the food with primary packaging. 
The food system also includes 12 salt 
tablets per crewmember, for each of 
two deorbit attempts, required for 
mitigating orthostatic intolerance on 
return. The stowage for the food and 
utensils is not provided by NASA and 
is not included in the mass and 
volume. The food is to be stored in a 
manner ensuring food quality and 
preventing puncture of packaging. 
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Total Minimum Rationale 
Mass (kg) Dimensions to 
be Provided 


Contamination 13,805 | 29.7 cm x 25.4 | In some onboard contamination 
Cleanup Kit cm x 18.3.cm_ | events, such as a spill, vehicle systems 
(11.7 inch x 10 | may be unable to remove the 
inch x 7.2 contaminant in a physiologically 
inch) relevant time-frame, and the 

crewmembers will have to perform the 
cleanup themselves or initiate 
operational steps to limit/reduce crew 
exposure in a more expedient time 
frame. The methods of contamination 
cleanup are a function of vehicle 
component materials, planned crew 
tasks which could result in 
contamination of the crew 
environment, and the capability of the 
ECLSS to maintain the environment. 
Examples of provisions include 
chemical and/or microbial wipes, toxic 
hazard labels and containment bags. 
The stowage for this kit is provided by 
NASA and is included in the mass and 
volume. 


Passive a 5.5cm x 3.0 | Passive Radiation Area Monitors 
Radiation Area cmx0.8cm_ | (RAMs) will be deployed pre-flight at 
Monitors (2.17 in x 1.18 | a minimum of 6 designated fixed 
in x 0.31 in) | locations within the crew cabin. The 
each total mass and volume are for 6 
monitors. The RAMs complement the 
crew worn personal dosimeters. 
Knowledge of the spatial distribution 
of exposure rate is necessary to 
identify areas that have a relatively 
high exposure rate (i.e., avoidance 
areas) and to reconstruct a 
crewmember's exposure in the event 
of lost or unusable personal dosimeter 
data. 


Crew Personal : The crew personal dosimeters are 

Dosimeters worn on each crew member. The total 
mass and volume are based on four 
crewmembers. The mass of each 
dosimeter is 0.1 kg. 
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Total 
Mass (kg) 


Medical Kit 


ISS Medical 45,935.4 


Accessory Kit 
(IMAK) 


Crew Worn-On 
Items 


ISS Crew 
Provisions 


Commercial Crew Program 
International Space Station Program 


Minimum 
Dimensions to 
be Provided 
25.4cm x 
17.8 cm x 15.2 
cm 
(10 inch x 7 
inch x 6 inch) 


25.4 cm x 25.4 
cm x 8.9 cm 
(10” x 10” x 
3.5”) each 


5 Half CTBs 
(packed) 
24.8cm x 
42.5cm x 
23.5cm (ea.) 


CCT-REQ-1130 
Revision: E-1 


Rationale 


The kit contents will support up to 4 
NASA crewmembers for the duration 
of operating capability of the 
commercial vehicle in which the crew 
flies. It will, at a minimum, have 
medications and supplies to treat 
conditions such as, but not limited to: 
Space Adaptation Syndrome, urinary 
retention, corneal foreign body, minor 
pain, fatigue and alertness issues, 
initial treatment of 
allergic/anaphylactic reactions, upper 
respiratory congestion and pressure 
blocks and other common minor 
illnesses, and minor abrasions, cuts, 
and small joint sprains. This kit is 
separate from the ISS Medical 
Accessory Kit (IMAK) for medical 
support during ISS operations. 
IMAKs contain personal crew medical 
items that are required to be 
transported with crewmembers. Each 
NASA crewmember is allocated two 
IMAKs weighing up 1.5 kg each. 
Each crewmember must have access 
to their IMAKs during flights longer 
than 6 hours in duration to support 
unique medical conditions that may 
occur prior to docking. 

This includes kneeboard, flashlight, 
notebook, pen, and other 
miscellaneous items. These items will 
be worn on the crewmembers. 


This includes clothing, hygiene, crew 
preference items, camera and lens for 
fly-around photography, and 
miscellaneous items. Many of these 
items will be the same product that 
they will use on their 180 day stay on 
ISS. 
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Appendix K: Crew Range of Motion 


The ranges of motion to be accommodated for crewmembers were collected in 1 g under a variety of 
suited and unsuited conditions as part of a 2007/2008 study in the NASA JSC Anthropometry and 
Biomechanics Facility. The values represented in these tables show the level of mobility that was needed 
to perform a variety of relevant functional tasks. These numbers do not necessarily indicate maximum 
level of mobility possible in a given configuration. Each table provides the range of motion for specific 
suited and gravitational conditions as described below. 


Table K-1 Range of Motion (Unsuited) provides several joint measures that were present in old versions 
of this table but were not reinvestigated as a part of the 2007/2008 mobility study. These values are 
specifically called out when listed in the table. 


Table K-2 Range of Motion (Suited/ Unpressurized) represents unpressurized-suited mobility 
requirements for design of components such as cockpit controls, seat restraints, seat stowage, and all 
other interfaces used by a crewmember wearing a suit that is not actively pressurized. 


Table K-3 Range of Motion (Suited/ Pressurized) represents pressurized-suited mobility requirements 
for design of components with which a crewmember will be expected to interact. 
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Table K-1: Unsuited Range of Motion 
(Page 1 of 4) 


Dorsiflexion Unsuited ROM 


Plantar Flex 
-50 *All Units in Degrees 


Plantar Flexion 
Unsuited ROM 


Extension 


*All Units in Degrees 


Unsuited ROM 


« 


AC ie 
Flexion 


+165° 


Hip 
Extension 


Flexion Extension 


-15 


! 
“65 


3 


Hip Hi 
External . oF t si *All Units in Degrees 
Rotation ere 

Rotation 


-35° “yy +35° 


Neutral Position 
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Table K-1: Unsuited Range of Motion 
(Page 2 of 4) 


Neutral Position Neutral Position Unsuited ROM 


+15° Torso fas! 
| Right Lean)! 
- ™ 
Torso ' 
Extension. ! 
Flexion I 


ee 


Torso 
| 0 


Torso CW Torso CCW 
Rotation Rotation 


*All Units in Degrees 


Neutral 
Position 


Unsuited ROM 


Shoulder 
Abduction 


*All Units in Degrees 


Unsuited ROM 


-70° 


Shoulde: 
Flexion 


a Neutral Position 
Neutral Position \ 
' 


' Shoulder 
' 
Shoulder | Shoulder | Rotation 
Interior , Exterior 
Transverse ! Transverse 
Rotation | Rotation 


-46° 


Transverse | Transverse 
Shoulder] 5 5¢4tion 


Shoulder 
-45° ' Rotation 
: Lateral 


*All Units in Degrees 
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Table K-1: Unsuited Range of Motion 
(Page 3 of 4) 


@ Elbow Unsuited ROM 


ae So 


Elbow Extension 


*All Units in Degrees 


west 


Adduction 


*All Units in Degrees 


+30° 


Neutral 
Position 


Unsuited ROM 
Abduction |Adduction 

Wrist |(Radial (UInar 
Deviation} |Deviation) 


Unsuited ROM 


Neutral Position Neutral Position 


+29° 


Neck Extension __1-34° Neck Flexion 
+65° 


lateral 


a: 


“35 


Pp 


*All Units in Degrees 


Neck Neck 
Rotation Rotation 
Right J/ Left 


Neck 1979 
Study 


-73° 


1 
Neutral Position 
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Neutral Position 

-30° ' 
Hip Interior 
Transverse 
Rotation 


+35° 


Hip Exterior 
Transverse 
Rotation 


CCT-REQ-1130 
Revision: E-1 


——o— ROM 


a 


Transverse | Transverse 
Hip 1979 Rotation 


Rotation 


*All Units in Degrees 


“1979 Study” refers to data from SP-2-86L-064 Thornton, W, and Jackson, J. Anthropometric Study of 
Astronaut Candidates, 1979 to 1980, (Unpublished Data) NASA-JSC. 
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Table K-2: Suited/Unpressurized Range of Motion 
(Page 1 of 3) 


: : \ Suited 
Dorsiflexion oes ES Unpressurized ROM 
+40° ps x 


Plantar Flex 
-30 


*All Units in Degrees 


Unpressurized ROM 


eo 


*All Units in Degrees 


Unpressurized ROM 


Flexion Extension 


130 -3 


Abduction |Adduction 
Int Rotation |Ext Rotation 


-30° 


Plantar Flexion 


o 


=) 


(2, 


Hip Hi hear 

" p * 
External internal All Units in Degrees 
Rotation Rotation 


+35° 


Neutral Position 
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Table K-2: Suited/Unpressurized Range of Motion 
(Page 2 of 3) 


Neutral Position 


Unpressurized ROM 


5 15 


Torso 
Right Lean \ 


Torso 
1 Left Lean 
-25° 


—— 


Torso CCW 
Rotation 


Torso CW 
Rotation 


*All Units in Degrees 


——— pressurized ROM 


Shoulder al 
= 
_—_o| 


*All Units in All Units in Degrees | 


Unpressurized ROM 


Neutral Position 


' 
’ -25° ! e Shoulder 
oe a—t_80 Rotation 
Medial 


Ad<dt'l 
Shoulder 


Medial 
| 25] 80) 
*All Units in Degrees 
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Table K-2: Suited/Unpressurized Range of Motion 
(Page 3 of 3) 


Flexion 


os 
. Unpressurized ROM 
cae 


aE 


*All Units in Degrees 


Unpressurized ROM 


Elbow 
Extension 


Wrist 
Extension 
— 


~ 


Wrist 
Flexion Sig; 
On Neutral Adduction 


— {Radial {Ulnar 
Deviation} |Deviation) 


Wrist \ 


Adduction / 


= 


\ Abduction 


Pronation 
| 80} (8) 


*All Units in Degrees 


+30° 


Neutral 
Position 
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Table K-3: Suited/Pressurized Range of Motion 
(Page 1 of 3) 


Suited Pressurized 


Dorsiflexion 3 zs ROM 
+40° YX 
es 72° 
Plantar Flex 


-2 


*All Units in Degrees 


Suited Pressurized 
ROM 


a ar 


*All Units in Degrees 


-20° 
Plantar Flexion 


Suited Pressurized 


Hip 
Flexion | 
Hip 
Abduction ) 


Hip 
Extension 


-20° 


‘! ¥ *All Units in Degrees 
External Anternal — ee 
Rotation 


Rotation 
-5° 


Neutral Position 
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Table K-3: Suited/Pressurized Range of Motion 


(Page 2 of 3) 
— siiapecaaiaen Suited Pressurized 
eutral Position i 
‘ ROM 
Torso - Torso Torso Torso 


Extension 4. Flexion | RightLean \ 1, Left Lean 


0° 


Flexion Extension 


Torso CW Torso CCW 
Rotation Rotation 


*All Units in Degrees 


Suited Pressurized 
ROM 
Shoulder 


o° 


1 
Neutral Position 


Shoulder 
Shoulder 


Flexion 
Abduction ) 
-110° I 


Abduction |Adduction 
*All Units in Degrees 


Suited Pressurized 


Neutral Position 


' 
anoae -25° | Should 
Shoulder ° ulder 
Interior } Exterior a 60° ‘Rotation 
Transverse Medial 
Rotation —— 
n 


Addt'l 
Shoulder 


*All Units in Degrees 
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Table K-3: Suited/Pressurized Range of Motion 
(Page 3 of 3) 


Elbow 
Flexion 


Suited Pressurized 
ROM 


Elbow Extension 
a en) 


*All Units in Degrees 


Suited Pressurized 
ROM 


Extension |Flexion 


Wrist -60° 


Neutral Abduction |Adduction 
Position {Radial (Ulnar 
Deviation) |Deviation) 


Supination 


Wrist 
Adduction 


[ Wrist 


’ Abduction 


Pronation 
ae a) 


u *All Units in Degrees 
25° I '428° 

Neutral 
Position 
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Appendix L: Crew Interfaces 


L.1. Cooper-Harper Rating Scale 


Reference information on use of the Cooper-Harper rating scale can be found in Section 4.6 of the JSC 
65995 CHSIP. 


Cooper-Harper Levels: 


— Level 1 (HQR 1, 2, 3): Satisfactory without improvement 
— Level 2 (HQR 4, 5, 6): Adequate performance, but deficiencies warrant improvement 
— Level 3 (HQR 7, 8, 9): Improvement is required; performance and/or workload are unacceptable 


Handling Qualities Rating Scale 


Adequacy for Selected Task Aircraft Demands on the Pilot in Selected Pilot 
or Required Operation Characteristics Task or Required Operation” Rating 


Excellent eos ei companeetin not a factor for desired 1) 
ES Highly desirable 
Fa ga OE 
Negligible deficiencies 2} Level 1 
Fair — Some mildly SH pilot compensation required for 
unpleasant deficiencies {desired performance 


Minor but annoying 
deficiencies 
No ciencies a . 
> at a conatte sicde Level 2 


Very objectionable but performance requires extensive 6) 
tolerable deficiencies si compenealion 


e performance not attainable with 
sideiia toletabia (lek companaaiod .7 ) 


N woencies 
pe 1 naa bevel 
provement rf 
mienee pilot compensation is required to 
Major deficiencies ain control (9) 


No Lmprovement ontrol will be lost during some portion of 
Somes o 


Pi i * Definition of required operation involves designation of fight phase 
pal decisions andioe subphases with accompanying conditions 


Figure L.1-1: Handling Qualities Rating Scale 


(= deficiencies 
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Table L.1-1: Input-Output Compatibility 
(Page 1 of 3) 


Device Direction of Movement and Result 


Knobs: 


Continuous and Turn clockwise with hand or fingers — turn function on, increase 
discrete position value, move discrete cursor right, move displayed page left 
rotary Turn counterclockwise with hand or fingers — turn function off, 
decrease value, move discrete cursor left, move displayed page 
right 


Ganged Turn each individual knob clockwise with hand or fingers — turn 
function on, increase value, move discrete cursor right, move 
displayed page left 

Turn each individual knob counterclockwise with hand or fingers — 
turn function off, decrease value, move discrete cursor left, move 
displayed page right 


Thumbwheels or scroll wheels 
(operated by brushing/turning the edge of the wheel): 


Vertical wheel Move thumbwheel/scroll wheel edge forward with thumb or finger 
orientation — turn function on, increase value, move a discrete cursor up, move 
displayed page down 


Move thumbwheel/scroll wheel edge backward with thumb or 
finger — turn function off, decrease value, move a discrete cursor 
down, move displayed page up 


Horizontal wheel Move thumbwheel/scroll wheel edge right with thumb or finger — 
orientation turn function on, increase value, move a discrete cursor right, move 
displayed page left 


Move thumbwheel/scroll wheel edge left with thumb or finger — 
turn function off, decrease value, move a discrete cursor left, move 
displayed page right 


Handwheels (operated | Rotate handwheel clockwise with hand — turn function on, increase 
by grasping the wheel's | the value, move discrete cursor right, move displayed page left 
perimeter and turning) | Rotate handwheel counterclockwise with hand — turn function off, 
Note: Excludes valve | decrease value, move discrete cursor left, move displayed page 
wheels right 


Pedals Apply pressure to pedal with foot — turn function on, engage action, 
increase value. 

Reduce pressure to pedal with foot — turn function off, disengage 
action, decrease value 


Momentary Press and release to activate object or select menu item 
pushbuttons Press to activate function; release to deactivate function 


Rocker switches: 
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Table L.1-1: Input-Output Compatibility 


(Page 2 of 3) 
Device Direction of Movement and Result 
Vertical rocker Depress upper wing with finger — turn function on, increase 
orientation value, move discrete cursor up, move displayed page down 


Depress lower wing with finger — turn function off, decrease 
value, move discrete cursor down, move displayed page down 


Horizontal switch | Depress right wing with finger — turn function on, increase 
orientation value, move discrete cursor right, move displayed page left 
Depress left wing with finger — turn function off, decrease value, 
move discrete cursor left, move displayed page right 


Push-pull controls Pull control with hand — turn function on 
Push control with hand — turn function off 


Slide/toggle switches: 


Vertical switch Slide/flip switch forward with fingers — turn function on or 
orientation increase value 

Slide/flip switch backward with fingers — turn function off or 
decrease value 


Continuous cursor | Move device forward with hand — cursor moves up, displayed 


control devices page moves down 
(joystick, mouse, | Move device backward with hand — cursor moves down, 
trackball, etc.) displayed page moves up 


Move device left with hand — cursor moves left, displayed page 
moves right 

Move device right with hand — cursor moves right, displayed 
page moves left 

Move device diagonally with hand in any direction — cursor 
moves diagonally in the same direction as the device's 
movement, displayed page moves diagonally opposite 
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Table L.1-1: Input-Output Compatibility 


(Page 3 of 3) 
Device Direction of Movement and Result 
Discrete cursor control | Press/deflect up key, switch, or button with finger — cursor moves 
devices (arrow keys, up, displayed page moves down 
castle switches) Press/deflect down key, switch, or button with finger — cursor 


moves down, displayed page moves up 

Press/deflect right key, switch, or button with finger — cursor 
moves right, displayed page moves left 

Press/deflect left key, switch, or button with finger — cursor moves 
left, displayed page moves right 

(If diagonal capability exists) Press/deflect key, switch, or button 
diagonally with hand in any direction — cursor moves diagonally in 
the same direction as the device's movement; displayed page moves 


diagonally opposite 
Rotational Hand Pivot controller forward — pitch vehicle down 
Controller (RHC) Pivot controller backward — pitch vehicle up 


Pivot controller right — roll vehicle right 

Pivot controller left — roll vehicle left 

Rotate control clockwise with hand — yaw vehicle right 
Rotate control counterclockwise with hand — yaw vehicle left 


Translational Hand Push in on control with hand — move vehicle forward 
Controller (THC) Pull out on control with hand — move vehicle backward 
Push right on control with hand —move vehicle to the right 
Push left on control with hand — move vehicle to the left 
Push up on the control with hand — move vehicle up 

Push down on the control with hand — move vehicle down 


NOTE: Movement directions are from the user's nominal perspective. When a control affects a cursor 
or an indicator on an electronic display, the control/display relationship of up and down 
movements may be dependent on the angle of the control mounting (with respect to the body 
and display) or on the prior experience of the user. The information in the table above 
assumes that the control is mounted in the horizontal plane and the display is in the vertical 
plane at roughly 90° to the body. Usability testing may be necessary to confirm the best 


mapping. 
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L.2. RESERVED 
L.3. System Usability Scale (SUS) 


System Usability Scale (SUS) 


Strongly 
disagree 


1.1 think that! would liketo 
use this system frequently 


2.1 found the system unnecessarily 
complex 


3.1 thoughtthe system was easy 
to use 


4.1 think that | would need the 
support ofatechnical personto 
be able to use this system 


5.1 found the various functions in 
this system were well integrated 


6.1 thoughtthere was too much 
inconsistency in this system 


7.1 would imagine that most people 
would learn to use this system 
very quickly 


8.1 found the system very 
cumbersome to use 


9.1 felt very confident usingthe 
system 


10. | needed to learn a lot of 
things before! could get going 
with this system 


Figure L.3-1: System Usability Scale 
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Appendix M: RESERVED 
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Appendix N: RESERVED 
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Appendix O: RESERVED 
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Appendix P: Reference Vehicle Endurance Timeline 


The below timeline is a notional reference mission based upon specified operations and contingencies 
and estimated nominal operations. It illustrates how the operations integrate, but is not a requirement. 
The requirements are only levied in Section 3, but are cited here for reference. 


Table P-1: Mission Phases and Durations 


Requirement Required Hours Comment 
Paragraph Operations 
Nominal 3.4.2.1 |Liftoff thru Protects 19 hours of phasing, 


docking allowing ~ 6 or more launch 
opportunities in 2 weeks. 


Hatch close to No Dedicated |No requirement. Assume no fly- 
landing Time 

Allocation 

Required 


1 hour margin 
Contingency 3 docking attempt on following 
Delay crew day. 
Docking Time docking attempt. 


- Port Allocation |Consumables not reserved. Use 
Relocation Required —_|contingency redocking 
consumables as available. 


i a Be - Flyaround Consumables not reserved. Use 
contingency redocking 
consumables as available. 


34.25 Safe Haven ISS provides attitude control. 
Spacecraft provides power. 
- Safe Haven ISS provides attitude control and 
with ISS power. Consumables not reserved. 


Power Use contingency redocking 
consumables as available. 


Deorbit Waive- Minimum of 24 hours of 

off consumables are always reserved 
for a delay of the first planned 
deorbit. An alternate supported site 
exists within this timeframe. This 
capability extended if other 
contingencies do not occur. 
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(1) Additional life support consumables including consumables for each crewmember to utilize a quick 
don mask are required for: 

e Feed a cabin leak for the time it takes to execute an emergency Deorbit (3.10.11.1.3) 

e Depress and purge for a fire/toxic atmosphere if the design utilizes depress/purge/repress 

(3.10.11.1.2) 

Only the larger of the two scenarios is required to be protected, per requirement 3.10.11.1.4. When 
executing an emergency deorbit while feeding the leak, additional deorbit waive-off consumables 
protection is no longer necessary. 


(2) SSP 50808 Section 3.3.11.1.5 "Safe without ISS Services" must also be protected serially with the 
above table. 


(3) Total mission endurance is architecture-dependent and may be driven by a mission scenario with a 
failure to dock, targeting a return to a supported landing site, followed by a 24 hour deorbit waive-off. 
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Appendix Q: Human System Interface Design Requirements 


The requirements in this section specify performance limits, component-level implementation, and 
design rules. These requirements reinforce higher-level parents called out in the body of CCT-REQ- 
1130, as depicted in Table Q.1-1. In many cases, verifying these component-level features reduces the 
scope (and potentially the cost) of the parent verifications. The Provider may flow these requirements 
directly into their design specification at the appropriate level, or offer a tailoring of the child, parent, or 
their verifications that will satisfy the need and generate commensurate objective evidence of 
compliance. 


Table Q.1-1: Parent-Child Traceability Matrix 


Parent Child Name 
Requirement Requirement 
Number Number 
Control Critical Hazards | Q. 1.3 Impulse Noise Limit - Head 
0.1.7 Pre-Launch Vibration Limit to 
— Prevent Motion Sickness 
Q.2.1 Mechanical Hazards 
Q.2.2 Hot Temperature Hazards 
Cold Temperature Hazards 
Crew Control of Power 
Electrical Hazard Potential 
3.2.3.3 Voice Communication in 0.63 Breathing Apparatus 
Breathing Apparatus _ Annunciator Intelligibility 
Assisted Vehicle Egress Crew Hatch Opening 
Crew Egress Paths 
Unassisted Vehicle Egress External Hatch Opening 
Hatch Operability 
Hatch Cover Operations 
Manual Pressure Equalization 
Hatch Latch Indicator 
Hatch Pressure Indicator 
Windows for Crew Tasks Q.3.11 Control Glare 
Window Optical Properties 
Window Frame Reflectance 
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Parent Child Name 
Requirement Requirement 
Number Number 
Crew Interface Usability | Q 1.8 Workstation Illumination 
Crew Interface Workload 
Operability of Controls Q.3.1 Use of Color 
Design Induced Crew eer 
Brrr 3.2 Data Availability 
Q.3.3 Display Area for Task Support 
Q.3.4 Design of Controls 
Q.3.5 Control Labeling 
Q.3.6 Control Coding 
Q.3.7 High-g Control Configuration 
Moderate-g Control 
Control Activation Indication 
Q.3.10 Interface Legibility 


Q.3.11 Control Glare 


3.10.4.5 Emergency Annunciations Loudspeaker Sound Limits 


Protect for Inadvertent Q.1.8 
Operation 


Workstation Illumination 
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Parent 
Requirement 
Number 
3.10.5.2.1 Noise level for 


Communication 


3.10.14.1 Hatch Bi-directional 
Operability 


3.10.17.2 Sleep Accommodations 


3.10.14.2 Hatch Windows 
3.10.20.2 Habitable Space Sizing 
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Requirement 
Number 
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Sleep 


Crew Restraints and Mobility 
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Q.1: Crew Environment 
Q.1.1 RESERVED 


Q.1.1V RESERVED 
Q.1.2 Intermittent Noise Limit 


The CTS shall limit intermittent A-weighted overall SPL emissions from noise sources that 
operate for 8 hours or less measured 0.6 m from the loudest point on the hardware, to the levels 
and nominal durations in Table Q.1.2-1 or less, over any 24-hour period during all mission 
phases except launch and entry. Note: This requirement does not apply to impulse noise. 
[R.CTS.233] 


Rationale: To provide for adequate speech intelligibility and habitability, levels in Table Q.1.2- 
I, "Intermittent Noise A-Weighted Overall Sound Pressure Level and Corresponding Durational 
Duration Limits (Measured at 0.6 M)" will limit intermittent noise levels of specific hardware 
items that are inherently noisy and operate for a short time period where alternative means for 
noise control are prohibitively expensive or impractical. Durations associated with 
contingencies need not be used to define the noise level. The nominal duration will be used to 
determine the appropriate noise level. These sound level and operational duration limits are 
taken from ISS requirements (SSP 57000, Pressurized Payload Interface Requirements 
Document). 


Table Q.1.2-1: Intermittent Noise A-Weighted Overall Sound Pressure Level and Corresponding 
Operational Duration Limits (Measured at 0.6 M) 


24-hour Period 
: 
: 
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*Applies only to noise sources that are crew-operated or that have 3 or less activations per day. 


Q.1.2V The CTS's intermittent noise shall be verified by test and analysis. Hardware qualifying for 
verification using this requirement shall meet Q.1.4 requirements. SPL measurements shall be made of 
the actual flight hardware in its flight configuration with closeouts installed. Hardware shall be operated 
across the expected range of settings, including settings corresponding to the expected highest noise 
levels. Analysis shall be used to include any measured acoustical effects of the hardware installation 
configuration or to combine measured sound pressure levels of hardware items that must be operated 
simultaneously when these factors are not accurately represented in field tests. If the noise generated by 
a specific hardware item is influenced by the operation of another hardware item, then these hardware 
items shall be tested together. Analysis shall also be used to calculate the maximum operational 
duration to include the total time during any 24-hour period that the hardware item operates above the 
continuous noise limits given in requirement 3.10.5.2.1. This verification shall be considered successful 
when the test and analysis (and any performed simulations) indicates that the maximum noise level for 
the duration of intermittent operation, measured 0.6 m from the loudest point on the hardware surface, 
meets the level and duration limits specified in Table Q.1.2-1. [V.CTS.233] 


Q.1.3 Impulse Noise Limit - Head 


The CTS shall limit impulse noise, measured at the crewmember's head location, to less than 140 
dB peak SPL during all mission phases, except launch and entry. [R.CTS.234] 


Rationale: A limit of 140 dB peak SPL for impulse noise will prevent acoustic trauma (reference 
MIL-STD-1474D). 


Q.1.3V The CTS's impulse noise limit shall be verified by test. The SPL measurements for this 
verification shall be made using the actual flight equipment. Formal verification is not required for 
equipment with impulse noises that have peak overall SPLs of less than 110 dB. Peak-hold sound 
pressure level measurements shall be made using a Type 1 sound level meter on all equipment that emits 
significant impulse noise at expected head locations. The frequency response of the sound level meter 
shall extend to at least 6 Hz at its lower limit. Measurement locations relative to specific noise sources 
must correspond to the shortest distance from the loudest point on the hardware to the closest possible 
crewmember head location. This verification shall be considered successful when the test results show 
that the peak overall sound pressure level measurements are less than 140 dB. [V.CTS.234] 


Q.1.4 Noise during Sleep 
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The CTS shall limit impulse and intermittent noise levels at the crewmember's head location to 
10 dB above NC-50 during crew sleep periods. Note: Communications and alarms do not need 
to meet this requirement. [R.CTS.235] 


Rationale: Impulse and intermittent noise must be limited to less than 10 dB above the 
background noise to avoid waking crewmembers who are sleeping. 


Q.1.4V The CTS's impulse and intermittent annoyance noise limit shall be verified by test. The 
measurements shall be made within the vehicle in the flight configuration. Hardware shall be operated at 
settings that occur during crew rest periods. Measurements shall be made at expected sleep station head 
locations. Measurement locations shall be no closer than 8 cm from any surface. Peak-hold sound 
pressure level measurements shall be made. The verification shall be considered successful when the 
test shows that the peak overall sound pressure levels are less than 10 dB above NC-50 during crew 
sleep periods. [V.CTS.235] 


Q.1.5 Narrow-band SPL 


The CTS shall limit the maximum SPL of narrow-band noise components and tones to at least 10 
dB less than the broadband SPL of the octave band that contains the component or tone. 
[R.CTS.236] 


Rationale: Limiting narrow band noise component and tone levels to 10 dB below the broadband 
level will prevent irritating and distracting acoustic conditions that could affect crew 
performance. 


Q.1.5V_ The tonal and narrow-band noise limit shall be verified by test. The measurements shall be 
made within the spacecraft in the flight configuration with integrated portable equipment, stowage, 
spacecraft installations, and closeouts installed. Hardware shall be operated across the expected range of 
operational settings (including settings corresponding to the expected highest noise levels). Equivalent- 
continuous sound level, Leq, measurements shall be made within each octave band with a 20-second 
averaging time. Tonal and narrow-band component measurements shall also be made using a Fast 
Fourier Transform (FFT) with a frequency resolution of 1 Hz. Measurements shall be made at expected 
work and sleep station head locations. The verification shall be considered successful when the test 
indicates that the maximum levels of tones and narrow band components, measured at all work and 
sleep station head locations, is at least 10 dB less than the NC-50 value in Figure Q.1.1-1, "NC Curves" 
and Table Q.1.1-1, "Octave Band SPL Limits for Continuous Noise" of the octave band that contains the 
component or tone. [V.CTS.236] 


Q.1.6 Vibration Limits during Crew Sleep 


The CTS shall limit vibration to the crew such that the frequency-weighted acceleration between 
1.0 and 80 Hz in each of the X, Y, and Z axes is less than 0.01 g rms for each 2-minute interval 
during an 8-hour crew sleep period. [R.CTS.222] 


Rationale: For long-duration exposure (~8.5 hours), smaller vibrations to which the crew is 
exposed can adversely affect crew sleep. International Standards Organization (ISO) 
6954:2000, Mechanical Vibration Guidelines for the Measurement, Reporting and Evaluation of 
Vibration with Regard to Habitability on Passenger and Merchant Ships, provides vibration 
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exposure guidelines for habitability onboard passenger and merchant ships to include sleep 
areas and reflects the occupant perception of the vibration in these areas. ISO-6954:2000, 
Section 7 states that vibration of 0.01 g rms or lower for crew accommodation areas in ships is 
not likely to draw adverse comments from occupants. 


Q.1.6V The crew sleep vibration limit requirement shall be verified by analysis. The analysis shall 
consider all possible sources of vibration during the onorbit phase. The analysis shall reflect the average 
acceleration levels expected to occur during an 8-hour sleep period. The analysis profile shall comprise 
a simulation of crew compartment vibration. In accordance with ISO Standard 6954:2000, Section 6, 
the minimum estimate period shall be 2 minutes in case of significant vibration frequency content below 
2 Hz. All acceleration estimates shall be weighted in accordance with ISO 6954:2000, Annex A using 
the frequency weighting Wa (Table A.1). The verification shall be considered successful when it is 
shown that the predicted vibration levels do not exceed the specified levels at the crew sleep station. 
[V.CTS.222] 


Q.1.7 Pre-Launch Vibration Limit to Prevent Motion Sickness 


The CTS shall limit vibration to the crew such that the frequency-weighted acceleration between 
0.1 to 0.5 Hz in each of the X, Y, and Z axes is less than 0.05 g rms for each 10-minute interval 
during the pre-launch timeframe. [R.CTS.223] 


Rationale: Low-frequency vibration, especially in the range between 0.1 and 0.5 Hz, has the 
potential to cause motion sickness over relatively short exposure periods. This may be 
encountered while the crew is in the vehicle during the pre-launch period, given that the tall 
vehicle stack may be susceptible to swaying back and forth. Reducing the amount of sway will 
prevent the onset of motion sickness during the pre-launch phase. For assessing vibration 
between 0.1 and 0.5 Hz, the Motion Sickness Dose Value (MSDV) is calculated in accordance 
with ISO 2631-1: 1997, Annex D, Equation D-1. Although the ISO 2631-1 limits the 
acceleration measurement for assessing motion sickness to the vertical direction, this is based on 
the assumption that the human is in the seated upright posture. Because the occupants of the 
subject vehicle will be in the semi-supine posture, the requirement is applied to all three 
orthogonal axes, X, Y, and Z. The purpose of the 10-minute integration time is to constrain the 
deviations around the permitted average sway during a 2-hour pre-launch period. 


Q.1.7V_ The pre-launch vibration limit shall be verified by analysis. The analysis shall consider all 
possible sources of vibration during the pre-launch phase after the crew is on-board. The weighted 
acceleration shall be calculated in accordance with ISO Standard 2631-1:1997 using the frequency 
weighting Wf applied in each X, Y, and Z direction (ISO Standard 2631-1:1997, Table 3). The 
verification shall be successful when the predicted vibration levels are below the specified limits for 
each representative 10-minute period of exposure. [V.CTS.223] 


Q.1.8 Workstation Illumination 


The spacecraft shall illuminate crew workstations in accordance with Table Q.1.8-1. 
[R.CTS.201] 


Rationale: Lighting needs vary, depending on the crew activities, operations, and visual tasks 
being performed. The crew will likely need the ability to adjust lighting (on/off, control intensity 
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and/or angle) for many cockpit tasks. For example, rendezvous and proximity operations may 
require general cabin darkening for out-the-window viewing but sufficient lighting for crew 
translation and manual control. To perform tasks at a workstation, directed lighting or 
control/display backlighting may be needed so as not to interfere with adjacent or concurrent 
tasks. Glare may be reduced by adjusting light intensity or prevented by appropriate selection, 
positioning, or direction of light sources. A single type of lighting at a single illumination level 
is insufficient to support all tasks; therefore, both general and task illumination are necessary. 
Lighting design should consider human factors, such as light color, surface reflectance, and 
glare. Design guidance can be found in NASA/SP-2010-3407, Human Integration Design 
Handbook (HIDH). Guidance on task analysis process can be found in Section 4.1 of JSC 
65995, CHSIP. 


Table Q.1.8-1 Spacecraft Illumination Levels 


| [Hatches 08 


| [Hands 08 
| [tadders OB 


Workstation 323 
Maintenance 269 = 
Controls 215 20 
Assembly 323 30 
Transcribing 538 50 
Tabulating 538 50 
Repair 323 30 
Panels (Positive) 215 20 
Panels (Negative) 54 5 
Reading 538 50 

Notes: 


(1) Levels are measured at the task object or 789 mm (30 in.) above floor, 
as applicable. 
(2) All levels are minimum. 


Q.1.8V Provisions for spacecraft interior lighting shall be verified through analysis and test. A crew 
task analysis shall be performed to determine crew tasks that require visual performance and identify 
workstations associated with those tasks. Test shall be performed using flight representative lighting 
system(s) and vehicle in the flight configuration. Illumination measurements are to be made on and 
normal to the task surface(s) with a subject positioned to perform the task. The verification shall be 
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considered successful when measurements show that illumination levels are within the ranges specified 
in table Q.1.8-1 to support expected crew tasks. [V.CTS.201] 


Q.1.9 Light Limits for Crew Sleep 


The spacecraft shall reduce the cabin light to 2 lux or less at the head location during sleep 
periods. [R.CTS.181] 


Rationale: External illumination can interfere with spacecraft operations, such as crew sleep 
and circadian rhythm. 


Q.1.9V_ The provision of lowering the cabin light levels at the crewmembers’ head location shall be 
verified by test. The test shall utilize an external light source whose illumination on the exterior of the 
windows shall be at least 132,000 lux on the largest of the windows directly facing the illumination 
source, while the majority of the rest of the system windows also face the illumination source to the 
maximum extent possible. There shall be no internal illumination sources present and the interior of the 
vehicle shall be completely darkened while the illumination near each window on the interior is 
measured. The verification shall be considered successful when the test shows that the spacecraft 
reduces the light level to 2 lux or less at the crewmembers head location. [V.CTS.181] 
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Q.2: Crew Hazard 
Q.2.1 Mechanical Hazards 


The CTS shall protect the crew from injury from: 

a) moving parts 

b) entrapment per SSP 50005 sections 6.3.3.4 and 6.3.3.5 

c) sharp edges per SSP 50005 sections 6.3.3.1, 6.3.3.2, 6.3.3.3, and 6.3.3.11 
d) sharp items 

e) burrs per SSP 50005 sections 6.3.3.9 

f) pinch points per SSP 50005 sections 6.3.3.8 

g) stored potential energy [R.CTS.248] 


Rationale: Hardware and equipment are to be designed to protect crewmembers from 
inadvertent contact with mechanical hazards, becoming trapped or snagged by fixed or loose 
items, and the release of stored energy. 


Mechanical hazards include items, such as hatch gears, that may catch clothing or hair, or cause 
injury. Historically, protection methods, such as covers or closeout panels, have been used to 
minimize risk of hazards. Entrapment can occur in places where loose cables or other restraint 
devices, such as tethers, strap, or nets, float in translation paths or habitable volume; equipment 
items or deployed hardware block passageways; or where clothing or appendages become 
snagged, such as in holes. Entrapment can also occur when crewmembers are unable to 
unfasten motion restraints (seat belts and shoulder harnesses, foot restraints, tethers, etc.), 

which is especially a concern under time-critical conditions when they need to evacuate. 


Sharp corners and edges in passageways, maintenance areas, stowage compartments, or 
workstations present hazardous conditions and are to be avoided. Also, hand-held items, such 
as tools, present a hazard to the crew. The force (and resulting damage) in contact with fixed 
items depends on the mass and speed of the crewmember. The damage from loose items, 
however, depends on the weight of the item. Therefore, the corners and edges of a loose item do 
not have to be as rounded as a fixed item. Although hand-held items are loose, they are 
squeezed, and forces can be high. Therefore, hand-held items are to meet the edge and corner 
rounding requirements of fixed items. Functionally sharp items are intentionally sharp (e.g., 
syringe, scissors, knives) and should be prevented from causing harm when not in nominal use. 
Removal of burrs can help to prevent personnel injury and damage to protective equipment from 
sharp edges during normal operations. 


Pinch points can cause injury to the crew, but may exist for the nominal function of equipment 
(i.e., equipment panels). This may be avoided by locating pinch points out of the crew's reach or 
providing guards to eliminate the potential to cause injury. Equipment (e.g., cables, fluid lines, 


Commercial Crew Program 
International Space Station Program Page 271 of 295 


ISS Crew Transportation and CCT-REQ-1130 
Services Requirements Document Revision: E-1 


air ducts, etc.) should also be protected from pinch points because damage to equipment may 
harm crew. 


This requirement addresses stored potential energy sources other than pressurized vessels and 
lines, pyrotechnics, and batteries which are addressed by separate requirements that levy 
appropriate standards. Other components and systems that retain potentially injurious levels 

of stored potential energy, such as hatch mechanisms, or systems with large springs, must either 
be designed to prevent a crewmember from unintentionally releasing the stored potential energy 
or be designed with provisions to allow safing of the potential energy including provisions to 
confirm that the safing was successful. 


Q.2.1V a. Moving Parts - The CTS protection of crew from moving parts that may cause injury shall 
be verified through analysis. An analysis shall be performed to identify potential mechanical hazards 
accessible to crew and their designed control measures. The verification shall be considered successful 
when the analysis shows that mechanical hazards are either inaccessible to crew or have acceptable 
control measures to prevent injury. 


b. Entrapment - The protection of crew from entrapment shall be verified through analysis and 
demonstration. An analysis shall be performed to identify potential sources for entrapment and their 
designed control measures. Demonstration of crew motion restraints shall be performed using flight 
representative retention systems to verify that crewmembers are able to release fasteners under 
simulated nominal and emergency conditions. The verification shall be considered successful when 
analysis and demonstration show that potential entrapment sources are controlled (reference Sections 
6.3.3.4 and 6.3.3.5 of SSP 50005) and that crew can release from motion restraints. 


c. Sharp Edges 


i. Sharp Edges for Corners - Corner and edge rounding for fixed and handheld equipment shall be 
verified by inspection. Inspections shall be made of drawings of fixed and handheld equipment to which 
the crew will be exposed for corner and edge rounding specifications. Inspections shall also be made on 
flight hardware focusing on exposed edges and corners with which the crew may come in contact. The 
verification shall be considered successful when the inspection confirms that corners and edges meet the 
exposed edge and roundness specifications in Sections 6.3.3.1, 6.3.3.2 and 6.3.3.3 of SSP 50005. 


il. Sharp Edges for Loose Equipment - Corner and edge rounding for loose equipment shall be verified 
by inspection. An inspection shall be made of drawings of loose equipment to which the crew will be 
exposed for corner and edge rounding specifications. The verification shall be considered successful 
when the inspection confirms that corners and edges meet the edge and roundness specifications in 
Section 6.3.3.11 of SSP 50005. 


d. Sharp Items - Crew protection from functionally sharp items shall be verified by analysis and 
inspection. An analysis shall be performed to identify physical control measures for functionally sharp 
edges. An inspection of drawings shall be performed to verify incorporation of the designed control 
measures. The verification shall be considered successful when the inspection of the design shows that 
functionally sharp items include the control measures to prevent injury. 


d. Burrs - Absence of burrs on surfaces shall be verified by inspection. An inspection of flight 
hardware focusing on exposed surfaces that the crew may contact shall be made. The verification shall 
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be considered successful when the inspection confirms that exposed surfaces are free of burrs (reference 
Section 6.3.3.9 of SSP 50005). 


f. Pinch Points - Prevention crew injury from pinch points shall be verified by analysis. An analysis 
shall be performed to identify potential pinch points accessible to crew and their designed control 
measures. The verification shall be considered successful when the analysis shows that pinch points 
are either inaccessible to crew or have acceptable control measures to prevent injury (reference Section 
6.3.3.8 of SSP 50005). 


g. Stored Potential Energy - The protection of crew from stored potential energy shall be verified 
through analysis. An analysis shall be performed to identify stored potential energy sources and their 
designed control measures. The verification shall be considered successful when the analysis shows that 
stored potential energy sources are inaccessible to crew or have acceptable control measures to prevent 
injury. [V.CTS.248] 


Q.2.2 Hot Temperature Hazards 


For materials having exposed surface temperature (TES) greater than 45°C (113°F), bare skin 
contact shall be controlled as follows. 


a. For incidental contact, defined as contact times of 1 second or less, calculate permissible 
material temperature (TPM) and implement control for hazard as follows. 


1. If TES is less than or equal to TPM, bare skin contact is permissible. 


2. If TES is greater than TPM, bare skin contact is not permissible; implement design control for 
hazard. 


b. For intentional contact, defined as planned skin contact for any length of time, calculate TPM 
for the expected contact time and implement control for hazard as follows. 


1. If TES is less than or equal to TPM, bare skin contact is permissible. 


2. If TES is greater than TPM, bare skin contact is not permissible; implement design control for 
hazard. [R.CTS.249] 


Rationale: To prevent pain and preclude skin damage, exposed IVA TES subject to contact by 
crew are to not cause the epidermis and dermis interface temperature from exceeding 44°C 
(111°F) and from dropping below 10°C (50°F), per NASA-STD-3001 Volume 2. When surfaces 
exposed to crew contact have extreme temperatures, either hot or cold, the hazards are to be 
controlled. Hazardous temperatures are established by the difference between TPM and the 
measured TES. The material temperature threshold 45°C (113°F) is based on research showing 
that skin damage occurs when temperature at the epidermis/dermis interface TE/D exceeds 44°C 
(111°F) (Moritz and Henriques, 1947). Analytical modeling of different contact times for two 
semi-infinite solids at different uniform initial temperatures found 45°C (113°F) to be the lowest 
damaging material temperature and therefore, an appropriate hot temperature threshold as a 
screening point for all commonly used materials. 
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Q.2.2V Hot touch temperature shall be verified by test and analysis. Test shall be conducted to 
measure temperature of hot surfaces that are exposed to crew contact. Where TES > 45°C (113°F), an 
analysis shall be performed to determine maximum TPM for those exposed surfaces. The verification 
shall be considered successful when test and/or analysis show that temperatures for exposed surfaces are 
lower than TPM and appropriate hazard control measures are implemented. 


TPM shall be calculated as follows: 


When calculating TPM for intentional contact, a minimum time of 10 seconds applies. Where contact 
time for nominal operations is planned to exceed 10 seconds, time increments for up to 30 seconds, up to 
60 seconds, or infinite time are to be used. Because contact time is a factor in establishing permissible 
material temperature, consider the following if there is potential for exceeding planned contact time: 


¢ Either calculate Tpm using higher or infinite contact time, especially if there may be an adverse 
consequence due to unplanned release of an object, or 


¢ Inform crewmembers of the contact time limit via an operational control that has been coordinated 
with the operations community. 


The equation for TPM assumes the object material is homogeneous. If the object is a layup of different 
materials (i.e., is comprised of layers), TPM is to be calculated using the thermophysical properties of 
the material with lowest value for inverse thermal inertia. Alternately, with justification, TPM may be 
calculated using the thermophysical properties of the material in the layup that is the largest contributor 
to the change in skin temperature. Refer to the NASA/SP-2010-3407, Human Integration Design 
Handbook (HIDH) for additional guidance on calculating TPM. 


1. For incidental contact, defined as contact time t < 1 second: 


Tru (°C) = a* (kpcy”?+b 


Where: 
(kpc)? = inverse thermal inertia of material (em* °C sec!”)/cal (Table Q.2.2V-1) 
a = 0.92 
b = 69.97 


2. For intentional contact, defined as planned skin contact for any length of time: 


Tru (CC) = a* (kocy* +b 


Where: 
(kpc)? = inverse thermal inertia of material (cm* °C sec!”)/cal (Table Q.2.2V-1) 
a, b = constants in Table Q.2.2V-2 Hot Temperature Constants for Intentional (Planned) 
Contact 


Table Q.2.2V-1: Inverse Thermal Inertia for Commonly Used Materials 


Inverse Thermal Inertia 


Material (koc)” 
((cm? °C sec)/cal) 
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586 (effective) 


k = thermal conductivity, o = density, c = specific heat 
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Table Q.2.2V-2: Hot Temperature Constants for Intentional (Planned) Contact 


Contact Time (s) a b 
10 0.48 50.07 
30 0.46 46.61 
60 0.45 45.90 
2 0.42 44.87 
Note: for intentional contact, a minimum time of 10 seconds applies 
when calculating Tew. 


Figure Q.2.2V-1 illustrates hot Tpm for incidental and intentional (planned) contact and four common 


materials. [V.CTS.249] 


4 


Hot Touch Temperature Limits 
135 75 


125 +4 


105 ++ 


95 +3 


g5 + 


~ 
SS 


75 4 


65 +3 


55 5 


Permissible Material Temperature T py (°C) 


' 
' 
' 
1 
1 
1 
' 
-- 
' 
' 
' 
+ 
i] 
i] 
i] 
+ 
' 
' 
' 
t 
' 
' 
\ 
' 
' 
' 
T 
' 
' 
i 
t 
if 


45 + 
0 10 20 30 40 #50 #60 #70 #80 90° 100 


1/(kpc)'2 (cm? °C s'2/cal) 


Figure Q.2.2V-1: Hot Temperature Limits 
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Q.2.3 RESERVED 
Q.2.3V RESERVED 
Q.2.4 Cold Temperature Hazards 


For materials having exposed surface temperature (TES) less than 0°C (32°F), bare skin contact 
shall be controlled as follows: 


a. For incidental contact, defined as contact times of 1 second or less, calculate permissible 
material temperature (TPM) and implement control for hazard as follows. 


1. If TES is greater than or equal to TPM, bare skin contact is permissible. 


2. If TES is less than TPM, bare skin contact is not permissible; implement design control 
for hazard. 


b. For intentional contact, defined as planned skin contact for any length of time, calculate TPM 
for the expected contact time and implement control for hazard as follows. 


1. If TES is greater than or equal to TPM, bare skin contact is permissible. 


2. If TES is less than TPM, bare skin contact is not permissible; implement design control 
for hazard. [R.CTS.251] 


Rationale: To prevent pain and preclude skin damage, exposed IVA TES subject to contact by 
crew are to not cause the epidermis and dermis interface temperature from exceeding 44°C 
(111°F) and from dropping below 10°C (50°F), per NASA-STD-3001 Volume 2. When surfaces 
exposed to crew contact have extreme temperatures, either hot or cold, the hazards are to be 
controlled. Hazardous temperatures are established by the difference between TPM and the 
measured TES. Research on human tolerance to cold has shown that when skin temperature is 
at 7°C (44.6°F) numbness occurs (Provins and Morton12) and at 0°C (32°F) frostbite is risked 
(Havenith et al. 10). While contact with objects at O°C (32°F) may elicit pain, the object will not 
cause skin temperature to drop below 0°C, which is the temperature at which frostbite damage 
can occur. 


Q.2.4V Cold touch temperature shall be verified by test and analysis. Test shall be conducted to 
measure temperature of cold surfaces that are exposed to crew contact. Where TES < 0°C (32°F), 
analysis shall be performed to determine the minimum TPM for those exposed surfaces. The 
verification shall be considered successful when test and/or analysis show that temperatures for exposed 
surfaces are higher than TPM and appropriate hazard control measures are implemented. 


TPM shall be calculated as follows: 


When calculating Tpm for intentional contact, a minimum time of 10 seconds applies. Where contact 
time for nominal operations is planned to exceed 10 seconds, time increments for up to 30 seconds, up to 
60 seconds, or infinite time are to be used. Because contact time is a factor in establishing permissible 
material temperature, consider the following if there is potential for exceeding planned contact time: 
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e Either calculate Tpm using higher or infinite contact time, especially if there may be an adverse 
consequence due to unplanned release of an object, or 


e Inform crewmembers of the contact time limit via an operational control that has been coordinated 
with the Operations community. 


The equation for Tpm assumes the object material is homogeneous. If the object is a layup of different 
materials (i.e., is comprised of layers), Tpm is to be calculated using the thermophysical properties of the 
material with lowest value for inverse thermal inertia. Alternately, with justification, Tpm may be 
calculated using the thermophysical properties of the material in the layup that is the largest contributor 
to the change in skin temperature. Refer to the NASA/SP-2010-3407, Human Integration Design 
Handbook (HIDH) for additional guidance on calculating Tpm. 


1. For incidental contact, defined as contact time t < 1 second: 


Tru (CC) = a* (kocy* +b 
Where: 
(kpc)? = inverse thermal inertia of material (em” °C sec!”)/cal (Table Q.2.2V-1) 
a,b = constants in Table Q.2.4V-1 Cold Temperature Constants for Incidental Contact 


2. For intentional contact, defined as planned skin contact for any length of time: 


Tem (CC) = a* (kpcy? +b 
Where: 
(kpc)? = inverse thermal inertia of material (cm* °C sec!””)/cal (Table Q.2.2V-1) 
a, b = constants in Table Q.2.4V-2 Cold Temperature Constants for Intentional (Planned) 


Contact 


Table Q.2.4V-1: Cold Temperature Constants for Incidental Contact 


time (s) (koc)”* a b 
< 43.5 -1.16 0 
1 : 
> 43.5 -0.88 -12.29 


Table Q.2.4V-2: Cold Temperature Constants for Intentional (Planned) Contact 


time (s) a b 
10 0.71 4.78 
30 0.62 9.51 
60 0.53 10.00 
<0 0.37 10.00 
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Note: for intentional contact, a minimum time of 10 seconds applies 
when calculating Tem 


Figure Q.2.4V-1 illustrates cold Tpm for incidental and intentional (planned) contact and four common 
materials. [V.CTS.251] 
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Figure Q.2.4V-1: Cold Temperature Touch Limits 
Q.2.5 Crew Control of Power 


The CTS shall provide crewmembers with capability to control the interruption of power to an 
electrical circuit and confirm the de-energized status of the circuit that requires crew access for 
maintenance or mate/demate of energized elements. [R.CTS.252] 


Rationale: The intent of this requirement is to provide the crew with the capability to interrupt 
power, as opposed to only remote ground control, so that a crewmember performing a 
maintenance action will have the ability to interrupt power to the area and confirm the de- 
energized status of the electrical circuitry before initiating work in that area. This is not only to 
protect the crew from potential electrical shock, but to protect against molten metal or other 
critical equipment damage from arcing or intermittent electrical contact. For equipment (i.e., 
low voltage audio, video, data systems, etc.) that is less than 180 watts and that mate/demate 
operations have been analyzed to pose no crew or equipment hazards, this requirement is not 
applicable. 


Q.2.5V_ Crew interruption of electrical power and confirmation of energized circuits shall be verified by 
analysis, inspection, and test. An analysis shall be performed to identify circuits that require crew 
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access for maintenance or mate/demate of energized elements. A test shall be performed on flight 
representative hardware and software to verify power can be removed for connectors planned to be 
mated and demated in flight. This requirement is not applicable for equipment (i.e., low voltage audio, 
video, data systems, etc.) that is less than 180 watts and that mate/demate operations have been analyzed 
to pose no crew or equipment hazards. The verification shall be considered successful when the analysis 
and inspection of drawings show that the system provides crew with the capability to energize/de- 
energize and confirm status of such circuits and when the test shows measured voltage indicates 0.0 
volts for circuits involved in this verification. [V.CTS.252] 


Q.2.6 Electrical Hazard Potential 


The CTS shall protect crewmembers from unintentional electrical current exposure and minimize 
electrical shock hazards by designing equipment to have the following: 


a. All conductive surfaces shall be bonded to the vehicle's electrically referenced ground. 
b. Circuit isolation shall be implemented such that: 


1. All equipment not permanently bonded to electrical ground reference has a chassis 
leakage current not to exceed 0.1mA (ac plus dc components) when referenced through 
an equivalent crew impedance; and 


2. The power inputs for all equipment are dc isolated from chassis/structure by a minimum 
of 1 mega ohm. 


c. A third independent hazard control shall be implemented for equipment not permanently 
bonded to electrical ground reference (e.g., portable equipment) when voltages produced or 
utilized by the equipment exceed 42.2 V peak (ac plus dc component). [R.CTS.253] 


Rationale: The intent of this requirement is to prevent electrical shock hazards through the 
design of appropriate levels of hazard control. This requirement applies to all non-patient 
equipment receiving, providing, or storing electric power, that are intended for crew operation 
(e.g., portable computers and other powered portable devices, electronic control panels, etc.). 
This requirement does not address equipment that captures or attaches to the human or breaks 
the skin or blood barrier, such as space suits or medical devices. Portable equipment is defined 
as any equipment not permanently bonded to the vehicle's electrical ground via surface mount or 
permanent ground strap. Note that insulated portable equipment may have conductive 
connectors that must be grounded. Any normal chassis (enclosure) leakage value will be below 
threshold of shock to qualify as a complete hazard control. All values are defined in IEC 60601- 
I, 3rd edition with the Leakage per 8.7.3-c with compliance to 8.7.4 and Voltage limits per 8.4.2- 
c. The values provided in paragraphs B and C are for hand-to-hand, both hands-to-feet, and 
hand-to-seat contact applications as defined in IEC/TR 60479-5 Effects of current on human 
beings and livestock - Part 5: Touch voltage threshold values for physiological effects. A third 
independent hazard control is typically a second ground wire or double-insulated circuitry. For 
non-patient equipment, a crew electrical shock hazard protection system utilizing Design for 
Minimum Risk (DFMR) criteria may be used in lieu of the fault tolerance approach. 
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Q.2.6V 


a. Verification of electrical bonding requirements shall be accomplished by a combination of 
test, analysis, and inspection. The verification shall be considered successful when the test, 
analysis and inspection show the design is compliant with documentation that meet the intent 
of NASA-STD-4003. 


b. Verification of circuit isolation requirements shall be accomplished by test. 


1. For all equipment not permanently bonded to electrical ground reference, a test shall be 
conducted to measure the chassis leakage current. The verification shall be considered 
successful when the chassis leakage current is shown to be less than 0.1 milliamps peak 
during steady state operations. The current is measured between the electrical ground 
reference, through a crew equivalent impedance, and to any point on the equipment 
enclosure accessible to the crew during normal operation (metal parts, knobs, grips, 
connectors, etc.). The typical test setup for leakage current measurements that include 
the "equivalent crew impedance" is shown in Figure Q.2.6V-1. 


2. For all equipment, a test shall be conducted to measure the dc isolation from 
chassis/structure. The verification shall be considered successful when each power input 
(hot and return) is dc isolated from chassis/structure by at least | megohm. 


c. Verification of a third hazard control for equipment not permanently bonded to electrical 
ground reference, where the possible current pathways are hand-to-hand, both hands-to-feet, 
or hand-to-seat, shall be accomplished by analysis or test, and inspection. An analysis or test 
shall be performed to identify if voltages produced or utilized by the equipment exceed 42.4 
V peak (ac plus dc component). For equipment exceeding 42.4 V peak, verification shall be 
considered successful when inspection of drawings or equipment confirm implementation of 
a third independent hazard control (typically a second ground wire or double-insulated 
circuitry). [V.CTS.253] 
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Figure Q.2.6V-1 Typical Test Setup for Leakage Current Measurements 


Q.2.7 RESERVED 


Q.2.7V RESERVED 
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Q.3: Crew Control Interfaces 
Q.3.1 Use of Color 


When color is used to convey meaning on a display for critical information and critical tasks, the 
spacecraft shall provide an additional cue. [R.CTS.140] 


Rationale: Redundant coding is required to accommodate the variability in people's capability to 
see color under different lighting conditions and to increase the saliency of identification 
markings. Redundant cues can include labels, icons, and speech messages. 


Q.3.1V The spacecraft's redundancy of color interface cues shall be verified by demonstration. The 
demonstration shall be performed using flight representative software, crew interfaces and a list of 
representative data types. The demonstration shall determine whether the color-coded interface 
components also provide a second cue to convey that meaning. The verification shall be considered 
successful when the demonstration shows that all color-coded interface components provide a second 
non-color cue when color is used to convey meaning. [V.CTS.140] 


Q.3.2 Data Availability 


The spacecraft shall inform the crew when a displayed data parameter is missing or unavailable. 
[R.CTS.141] 


Rationale: Feedback on data that are unavailable (i.e., lost or stale) is critical to the crew for 
accurately weighing data during troubleshooting and decision-making periods. 


Q.3.2V_ The spacecraft loss of displayed data parameters shall be verified by demonstration. The 
demonstration shall be performed using flight representative software and crew interfaces and a list of 
representative data types. The demonstration shall run a scenario that results in the loss of data 
parameters for the data sets being tested. The verification shall be considered successful when the 
demonstration shows that the vehicle provides an indication to the crew that the parameters for each 
tested data set are unavailable. [V.CTS.141] 


Q.3.3 Display Area for Task Support 


The spacecraft shall provide the display area necessary to present information required for a 
critical task simultaneously to a single operator who is performing the critical task. [R.CTS.145] 


Rationale: Rapid response to mission-critical tasks will require simultaneous display of multiple 
sources of information to a single crewmember. Without sufficient display area, crewmembers 
may be faced with cumbersome and time-consuming display navigation operations that will 
increase information access time and potential for errors. Critical task information needs to be 
viewed simultaneously. This requirement might be met with a large display device or multiple 
smaller ones, but regardless, the information must be readable and usable. This requirement 
should not be used to justify a highly dense, cluttered display design; rather, it requires careful 
analysis of the specific information required of a critical task. Please refer to the usability 
requirement verification for more details on defining a task. 
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Q.3.3V_ The spacecraft's capability of supporting simultaneous viewing of critical task information shall 
be verified by analysis. The analysis shall determine for each critical task: 1) the limited set of 
information required for that critical task, and 2) whether or not the identified information can be 
simultaneously displayed, in a readable, usable form within the field of regard of a suited and seated 
crewmember performing the task. The verification shall be considered successful when the analysis 
shows that the vehicle can simultaneously display the information needed for each critical task. 
[V.CTS.145] 


Q.3.4 Design of Controls 


Spacecraft controls that are intended for out-of-view operation shall be spatially or tactually 
distinct from one another. [R.CTS.146] 


Rationale: When the crew inadvertently operates the wrong control, serious errors can result. 
Controls designed to be out-of-view while being operated must be spaced or shaped/textured 
such that the control can be identified without line of sight. This would include controls for 
vehicle operation as well as other controls (e.g., seat positioning). It has been shown that human 
operators can use simple tactile coding to reliably distinguish between items. Inadvertent 
operation prevention must be provided in accordance with NPR 8705.2B, Section 3.2.4. 


Q.3.4V The crew ability to operate out-of view controls shall be verified by analysis and test. A task 
analysis shall be performed to identify human activities required for nominal and off-nominal operation 
in the applicable mission phases and environments. The task analysis shall identify controls intended for 
out-of-view usage. Tasks where out of view controls are used shall be tested for error rates. The 
verification shall be considered successful when the error testing shows that out of view controls are 
acceptable per 3.10.4.4, Design Induced Crew Errors. [V.CTS.146] 


Q.3.5 Control Labeling 
The CTS shall provide labeling for crew interfaces. [R.CTS.147] 


Rationale: Crew interface items include vehicle location and orientation, hardware and 
equipment, cables and connectors, controls and displays, stowage compartments, etc.; anything 
with which crew may interact. Crew interface items are to have identifying labels to aid in crew 
in performing nominal and emergency operations, identifying location or orientation, or 
identifying hazards, etc. Clearly identifying items with function based readable labeling using 
text size appropriate for the item and its operational use and located directly adjacent to items 
being labeled reduces cognitive load and improves task efficiency by allowing crewmembers to 
quickly locate and recognize needed operational interfaces. Guidance on implementation of 
labeling for crew interfaces can be found in Section 4.13 of JSC 65995, CHSIP. 


Finally, a common operational language is needed to ensure clear communication and 
understanding of information the crew must process, manage, or take action on. English is the 
common operational language for the ISS, as specified in SSP-50200, SPIP Volume 9. 
Furthermore, consistent use of terminology and naming, including operational nomenclature 
and acronyms, is needed to ensure clear communication. The ISS program has a well- 
established OpNom and acronym library and process for assigning OpNom, which is described 
in SSP 50254 — Operations Nomenclature. 
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Q.3.5V The CTS labeling of crew interfaces shall be verified through inspection. The inspection shall 
consist of inspection of the vehicle Label Plan, drawings, and other relevant vehicle design and 
operational documentation. The verification shall be considered successful when the inspection shows 
that crew interfaces are identified with labeling. [V.CTS.147] 


Q.3.6 Control Coding 


The spacecraft shall provide coding for emergency controls that are distinguishable from non- 
emergency controls. [R.CTS.148] 


Rationale: Coding for emergency controls should allow the operator to distinguish them from 
other controls. This will help the operator react faster in an emergency situation. It has been 
shown that operators react more quickly to simple coding such as colors and pictures than they 
do to written labels. A task analysis defines the list of emergency controls. Guidance on the 
development of hazard, caution and warning, and emergency use labels and coding can be found 
in Section 4.13 of JSC 65995. 


Q.3.6V The spacecraft's coding for emergency controls shall be verified by analysis and inspection. A 
task analysis shall be performed to identify human activities required for nominal and off-nominal 
operation in the applicable mission phases and environments. The inspection of emergency controls 
shall include a review of the vehicle Label Plan and determine whether coding is compliant. The 
verification shall be considered successful when the inspection shows that coding meets the emergency 
coding defined in SSP 50005, Section 9.5.3.2.1.(4), IVA Coding Design Requirements, Familiar Color. 
[V.CTS.148] 


Q.3.7 High-g Control Configuration 


The spacecraft shall configure controls used during accelerations above 3 g so that the crew can 
make control inputs via hand/wrist movements of a supported limb without reaching. 
[R.CTS.150] 


Rationale: Above 3 g, controls must be operable by a restrained crewmember. In a study of 
reaches under Gx loading with veteran astronauts and aviators as suited subjects, there was a 
6% reduction in forward reach displacement at 3 g, 18% at 4 g, and 32% at 5 g (Schafer & 
Bagian, Aviation, Space, and Environmental Medicine, 64: 979, 1993). Above 3 g, the accuracy 
of gross limb movements is compromised, and thus control action under these conditions should 
be limited to hand and wrist motions alone. 


Arms/legs will require proper support and/or restraint to allow for accurate control inputs 
during elevated g conditions and to prevent inadvertent control inputs during high-g nominal 
and abort scenarios. Proper arm/wrist support should be provided such that operation of any 
hand controller is not hampered by g-loading. 


Q.3.7V The spacecraft's control placement for operations at 3 g or more shall be verified by analysis. A 
task analysis shall be performed to identify human activities required for nominal and off-nominal 
operation in the applicable mission phases and environments. The analysis shall be performed using a 
list of controls used during operations at 3 g or more as determined by the task analysis. The analysis 
shall determine whether the controls can be accessed by a hand/wrist movement of a 
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restrained/supported arm taking into account the full anthropometric range of crewmembers. The 
verification shall be considered successful when the analysis shows that controls used in operations at 3 
g or more are accessible by hand/wrist movements of a restrained/supported arm. [V.CTS.150] 


Q.3.8 Moderate-g Control Configuration 


The spacecraft shall configure controls used during accelerations between 2g and 3g so that the 
crew can make control inputs via hand/wrist movements of a supported limb and reaches within 
a forward +/-30 degree cone. [R.CTS.151] 


Rationale: Between 2 g and 3 g, controls must be operable by a restrained crewmember. Ina 
study of reaches under Gx loading with veteran astronauts and aviators as subjects, suited 
subjects on average exhibited little impact at 2 g but did show a 6% reduction in maximum 
forward reach displacement at 3 g (Schafer & Bagian, Aviation, Space, and Environmental 
Medicine, 64: 979, 1993). Hence, between 2 g and 3g, even with highly motivated and trained 
subjects, reaches will begin to show errors above 2 g, and so control actions should be limited to 
hand/wrist motions or forward arm movements within a +/- 30 degree cone (apex at the shoulder 
joint, aligned with the axis of acceleration). For tasks requiring rapid response times or for 
deconditioned crew, a more conservative approach with controls placed to minimize reach - 
allows for an improved crew ability to operate the control. Awkward shoulder/elbow postures, 
which could result from reaches to displays/interfaces at close distances, increase fatigue and 
errors resulting in high crew workloads that could exceed workload requirements. Additionally, 
proper arm/wrist support should be provided such that operation of any hand controller is not 
hampered by g-loading. 


Q.3.8V Control placement for operations between 2 g and 3 g shall be verified by analysis. A task 
analysis shall be performed to identify human activities required for nominal and off-nominal operation 
in the applicable mission phases and environments. The analysis shall be performed using a list of 
controls used during operations between 2 g and 3 g as determined by a task analysis. The analysis shall 
determine whether the controls can be accessed either by hand/wrist movements of a 
restrained/supported arm or by forward reaches taking into account the full anthropometric range of 
crewmembers. The verification shall be considered successful when the analysis shows that controls 
used during operations between 2 g and 3 g are accessible by hand/wrist movements of a 
restrained/supported arm or by a reach within a forward +/- 30 degree cone. [V.CTS.151] 


Q.3.9 Control Activation Indication 


The spacecraft shall provide a positive indication of crew-initiated control activation for critical 
functions. [R.CTS.144] 


Rationale: A positive indication of control activation is used to acknowledge the system receipt 
of the control action. For example, a physical detent, an audible click, an integral light, or a 
switch position may be used to provide a positive indication of control activation. 


Q.3.9V The spacecraft's feedback of crew-initiated control activation shall be verified by 
demonstration. The demonstration shall consist of simulating crew activation of flight representative 
hardware and software controls. The verification shall be considered successful when the demonstration 
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shows that all control systems provide an indication of crew-initiated control activations for critical 
functions. [V.CTS.144] 


Q.3.10 Interface Legibility 


The spacecraft shall provide crew interfaces that are legible under nominal conditions. 
[R.CTS.368] 


Rationale: Legibility is important for the crew's timely and accurate processing of information. 
Legibility may vary depending on vehicle conditions (for example, acceleration, vibration, and 
lighting) and must be accommodated. For example, during flight phases where high vibration is 
expected, relevant displays may need to be designed with this in mind (for example, analog 
versus digital displays, larger graphics and text. 


Q.3.10V The legibility of crew interfaces shall be verified by analysis and test. A task analysis shall be 
performed to identify human activities required for nominal operation in the applicable mission phases 
and environments. The tasks shall be reviewed to determine relevant legibility data to identify the 
interfaces that need to be read and interpreted, and the correlating vehicle conditions and environments. 
The test shall consist of a legibility test conducted with a minimum of five participants in a flight 
representative vehicle in the flight configuration. The legibility test shall consist of rapid serial visual 
presentation and subsequent verbal identification by subjects of a representative selection of targets such 
as hardware labels and software elements (alphanumeric, icons, and symbols). The verification shall be 
considered successful when the test shows an average identification accuracy of 98% for each type of 
target. [V.CTS.368] 


Q.3.11 Control Glare 


The spacecraft shall control glare on windows and displays in support of crew tasks. 
[R.CTS.369] 


Rationale: The wide range of operating orientations of the spacecraft will create many instances 
in which the sun will shine directly on the console or windows creating substantial glare and 
impede crew operations. The provider must plan for these orientations and enable safe 
operations by blocking stray light with covers, shutters or other means to eliminate glare. 


Q.3.11V The spacecraft's control of glare on windows and displays shall be verified by demonstration. 
The demonstration shall utilize a flight representative vehicle in the flight configuration with 
representative sunlight on the vehicle and glare control in place. The verification shall be considered 
successful when the demonstration shows that the displays are legible and windows for viewing tasks 
are free of glare. [V.CTS.369] 
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Q.4: Crew Task Support 
Q.4.1 Captive Fasteners 


All fasteners used by the crew shall be captive. [R.CTS.137] 


Rationale: Fasteners can be lost either by loosening during normal use or by becoming 
misplaced during maintenance operations. This is particularly important in zero gravity 
environments, because small items, such as fasteners, can be very difficult to find, replacements 
parts are not available, and lost parts can cause jams in mechanisms or problems in other 
spacecraft systems. Additionally, to enhance operational efficiency, the number and variety of 
fasteners to be removed by the crew should be minimized. 


Q.4.1V Use of captive fasteners shall be verified by inspection. Drawings of hardware and equipment 
requiring crew maintenance and using fasteners will be inspected. The verification shall be considered 
successful when the inspection confirms that fasteners are retained when unfastened. [V.CTS.137] 


Q.4.2 Stowage Locations 


The spacecraft shall provide defined stowage locations and restraints for both stowed and 
deployed items to prevent interference with crew operations or injury to the crew. [R.CTS.212] 


Rationale: Portable items are those items not permanently attached to the vehicle such as food, 
personal items, medical kits, trash, etc. To maintain a habitable volume and high level of 
efficiency and safety in crew operations, it is important to use a human centered design 
approach so that stowage locations are: 1) easily accessible (e.g., items located at their point of 
use or consumption, frequently used items can be accessed without having to remove other items, 
items can be removed and replaced, etc.) and 2) functionally arranged (e.g., all items required in 
a single task or procedure located together, grouped items accessible in priority order). 
Guidance on the human centered design approach can be found in Section 3.1 of JSC 65995. 
Information on using task analysis process in design can be found in Section 4.1. 


Securing items from unintended movement ensures crew and equipment safety and prevent items 
from moving out of their stowed locations under expected conditions for acceleration, vibration, 
or crew contact. In microgravity, retaining stowage restraints facilitates removal and 
replacement of stowed items when restraints are opened/loosened. For example, attached covers 
should be retainable in open position to allow crewmembers to access stowed items without 
requiring the crewmember to hold the cover. 


Hardware, equipment, and loose items generated during operations that are deployed in the 
habitable volume should be restrained to protect crew from collision injury, protect equipment 
from damage, or prevent loss. Appropriate restraints and/or handholds are to be considered for 
items that are grasped or gripped to be moved by crewmembers. 


Q.4.2V The spacecraft's defined stowage locations and restraints for portable items shall be verified 
through analysis and demonstration. An analysis shall be performed to evaluate the effect of expected 
acceleration, vibration, and crew forces on the restraints of stowed items. The demonstration shall be 
performed using flight-representative stowage with restraints. The demonstration will show that an 
operator can stow and restrain, and un-stow and un-restrain, representative items and that restraints can 
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be retained to facilitate stowage operations. The verification shall be considered successful when the 
analysis and demonstration show that defined stowage locations and restraints are provided for stowed 
and deployed items that prevent interference with crew operations and protect the crew from injury, 
equipment from damage, and prevent loss. [V.CTS.212] 


Q.4.3 Location Coding 


The CTS shall use a location coding system to provide a unique identifier for each defined 
location within the spacecraft. [R.CTS.214] 


Rationale: Location coding provides a clear and consistent method for referring to or finding 
different locations within the vehicle. Locations identifiers facilitate spatial awareness and 
communication when traversing the vehicle or locating equipment or workstations. The ISS has 
an established method for location coding, which can be found in SSP 30575, Space Station 
Interior and Exterior Operational Location Coding System. This method may be used as 
guidance for developing vehicle location coding. 


Q.4.3V The CTS's coding of locations within the spacecraft shall be verified by inspection. Drawings 
and CAD models of defined locations within the spacecraft shall be inspected. The verification shall be 
considered successful when inspection confirms that unique identifiers are provided for defined 
locations within the spacecraft. [V.CTS.214] 


Q.4.4 Crew Restraints and Mobility Aids 


The spacecraft shall provide crew restraints and mobility aids for all functions required by the 
crew. [R.CTS.215] 


Rationale: Crew restraints provide for operator stability. Mobility aids allow crewmembers to 
efficiently and safely move from one location to another in microgravity. Where it is critical that 
a crewmember remain stable for task performance (such as viewing through an eyepiece, 
operation of a keyboard), foot restraints and other ad hoc positioning techniques are insufficient 
for tasks performed continuously for long periods of time. Restraining system design is to take 
into account proper duration and be stable and intuitive, requiring little to no training to 
operate. Body posture and required motions for the task must be considered. For example, two- 
handed tasks require proper foot restraints and not hand holds to maintain a static posture. 
Proper crew restraints are critical while operating controls in docking or vehicle control 
scenarios. 


A crewmember should be able to operate controls in reduced gravity, as well as during dynamic 
or multi-axis accelerations. Maintaining a position and orientation during controls operation is 
necessary to ensure that controls can be activated without motion being imparted to the 
crewmember. There is extensive crew feedback on existing restraints and their use that can aid 
the design process. Early experience in the Skylab program showed the problems of movement 
in microgravity. Stopping, starting, and changing direction all require forces that are best 
generated by the hands or feet. Appropriately located mobility aids make this possible. Mobility 
aids are to be designed to accommodate a pressurized suited crewmember by providing 
clearance, non-slip surfaces, and noncircular cross sections. Without predefined mobility aids, 
personnel may use available equipment that could be damaged from induced loads. Mobility 
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aids should be standardized. By standardization of the mobility aids, reduction in crew training 
can occur, and the aids can be easily identified when translating within a spacecraft volume. 


Q.4.4V_ The spacecraft's crew restraint and mobility aid placement and design shall be verified by 
analysis and inspection. A task analysis shall be performed to identify tasks requiring operator stability 
and translation activities in the applicable mission phases and environments. The inspection shall 
consist of a review of engineering drawings, 3D CAD models, and identified locations of mission tasks 
and translation paths. The verification shall be considered successful when the inspection shows that 
restraint and mobility aid placement and design accommodate motions and body posture of the crew in 
their flight configuration required for the task. [V.CTS.215] 
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Q.5: Hatch and Window Design 
Q.5.1 Crew Hatch Opening 


The primary crew ingress/egress hatch shall fully open in less than 30 seconds of the crew 
initiating the opening. [R.CTS.168] 


Rationale: The primary crew ingress/egress hatches should move to the full-open position in a 
timely manner to minimize hindrances to crew egress in emergency scenarios. The full-open 
time requirement is applicable under worst-case, no-damage pressures. 


Q.5.1V The full opening of the primary crew ingress/egress hatch by flight crew inside the vehicle 
within 30 seconds of initiation shall be verified by demonstration. The demonstrations shall be with a 
flight representative hatch and crew in the flight configuration. The verification shall be considered 
successful when the demonstration achieves full opening of the hatch within 30 seconds. [V.CTS.168] 


Q.5.2 External Hatch Opening 


The primary ingress/egress hatch shall have an externally operated emergency mode that will 
allow the hatch to be opened in no more than 60 seconds after rescue personnel arrive at the 
spacecraft outer mold line. [R.CTS.169] 


Rationale: The primary ingress/egress hatch must be able to be quickly opened by rescue 
personnel in order to assist the crew with spacecraft egress in emergency scenarios. For 
example, a ground assisted egress mode is required in the event that the flight crew becomes 
incapacitated and is unable to egress the spacecraft. This mode will be initiated by rescue 
personnel upon their arrival at the area that allows the external hatch access into the spacecraft. 


Q.5.2V_ The full opening of the primary ingress/egress hatch by rescue personnel outside the vehicle in 
no more than 60 seconds shall be verified by demonstration. The demonstration shall be with the rescue 
personnel and spacecraft in their nominal pre-launch and post-landing configuration. The verification 
shall be considered successful when the demonstration achieves full opening of the primary hatch in no 
more than 60 seconds after rescue personnel arrive at the spacecraft outer mold line. [V.CTS.169] 


Q.5.3 Hatch Operability without Tools 


Hatches shall be operable by a single crewmember inside the spacecraft without the use of tools 
during all phases when the hatch is used. [R.CTS.171] 


Rationale: Hatch operation includes unlatching/opening or latching/closing the hatch. Lost or 
damaged tools prevent the hatches from being opened or closed, which may result in loss of crew 
or loss of mission. 


Q.5.3V_ Hatch operability by a single crewmember without the use of tools shall be verified by 
demonstration. The demonstration shall occur in a flight representative vehicle. The demonstration 
shall consist of a subject performing the following tasks while in the flight configuration: unlatching and 
fully opening each hatch from the inside and closing and latching each fully-opened hatch from the 
inside. The verification shall be considered successful when the demonstration shows that the hatch is 
operable by a single crewmember without the use of tools. [V.CTS.171] 
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Q.5.4 Hatch Operations 
Hatches shall require two distinct and sequential operations to unlatch. [R.CTS.172] 


Rationale: Inadvertent hatch opening and subsequent cabin depressurization would be 
catastrophic. Requiring two separate, distinct operations helps to ensure that the hatch will not 
be unlatched through accidental contact. The forces required to operate hatches must also be 
within the strength range of the weakest anticipated crewmember for the worst-case pressure 
differential anticipated. Prevention of inadvertent operations is required per NPR 8705.2B, 
Section 3.2.4. 


Q.5.4V Two distinct and sequential hatch unlatching operations shall be verified by demonstration. A 
demonstration shall be performed in a flight-representative vehicle with the hatch and crew in the flight 
configuration. The verification shall be considered successful when the demonstration shows that 
unlatching requires two distinct and sequential operations. [V.CTS.172] 


Q.5.5 Manual Pressure Equalization 


The hatch shall contain a manual pressure equalization system operable by a single crewmember 
on both sides of hatch. [R.CTS.173] 


Rationale: Air pressure is to be equalized on either side of a hatch to safely open the hatch. 
Manual pressure equalization capabilities must exist on each side of the hatch and be operable 
by a single crewmember during all required flight phases. In some vehicle failure scenarios, 
non-manual methods for pressure equalization may fail (loss of power, etc.). Manual pressure 
equalization enables hatch opening regardless of vehicle status. 


Q.5.5V Operation of the manual pressure equalization on each side of the hatch by a single 
crewmember shall be verified by analysis and demonstration. An analysis shall determine the maximum 
over and underpressure possible in nominal and contingency scenarios. A demonstration shall be 
performed on a flight-representative hatch with the hatch and designated crew in the flight 
configuration. The demonstration shall consist of performing a manual pressure equalization procedure 
on both sides of each hatch at the maximum expected internal/external pressure differentials. The 
verification shall be considered successful when the demonstration shows that the hatch can be opened 
after manual pressure equalization by a single crewmember. [V.CTS.173] 


Q.5.6 Hatch Latch Indicator 


The pressure hatches shall indicate closure and latch position status on both sides of the hatch. 
[R.CTS.175] 


Rationale: Indication of hatch closure and latch position status on both sides of the hatch allows 
both ground personnel (launch pad) and crewmembers to verify that each hatch is closed and 
latched. The combination of hatch closure and latch position status indicates proper security of 
the hatch. Hatch closure implies that the hatch is in proper position to be latched. 


Q.5.6V Hatch cover closure and latch position status shall be verified by demonstration. The 
demonstration shall occur with a flight-representative vehicle. The demonstration shall consist of the 
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following tasks: 1) opening the hatch and identifying that the hatch closure status indicates that the hatch 
is open 2) closing the hatch and identifying that the hatch closure status indicates that the hatch is closed 
3) latching and identifying the latch status indicates the latch is closed; 4) opening the latch and 
identifying that the latch position status indicates that the latch is open. The verification shall be 
considered successful when the demonstration shows that the hatch closure and latch position status is 
displayed from each side of each hatch. [V.CTS.175] 


Q.5.7 Hatch Pressure Gauge 


The pressure difference across the hatch shall be indicated on both sides of the hatch. 
[R.CTS.176] 


Rationale: Direct pressure difference measurement on both sides of the hatch allows both 
ground personnel and crewmembers to see the changes in pressure across the hatch and to know 
when the pressure difference is low enough to safely open the hatch. 


Q.5.7V Pressure difference measurement across the hatch shall be verified by test. The test shall occur 
on a flight-representative hatch. The test shall consist of ground and designated crew in their flight 
configuration reading the pressure difference measurement on both sides of each hatch throughout the 
range of expected internal/external pressure levels. The verification shall be considered successful when 
the test shows that the pressure differences are indicated on each side of the hatch. [V.CTS.176] 


Q.5.8 Window Optical Properties 


The spacecraft shall provide optically uniform windows with optical performance properties 
consistent with tasking that meet the intent of JSC 66320, Optical Property Requirements for 
Glasses, Ceramics, and Plastics in Spacecraft Window Systems. [R.CTS.179] 


Rationale: The windows must be of sufficient optical performance so that they do not degrade 
visual acuity and performance. JSC 66320 provides optical properties for different types of 
windows according to their associated tasks. NASA STD-3001, NASA Space Flight Human 
System Standard, Volume 2: Human Factors, Habitability, and Environmental Health - 
Architecture - Windows and NASA/SP-2010-3407, NASA Human Integration Design Handbook 
(HIDRH) - Architecture - Window, and HIDH Appendices C, D, and E provide additional 
reference material, design guidance, and lessons learned. 


Q.5.8V System window optical performance characteristics and tasking consistency shall be verified by 
analysis, inspection, and test. The analysis shall include a task analysis to identify the windows of the 
spacecraft and the nominal and off-nominal tasks to be performed at each window. The inspection shall 
assess the optical properties of the windows and consist of an inspection of the engineering drawings 
and data packs for each pane and the finished window stack. The test shall consist of optical tests. 
Visual uniformity inspections shall be done on the finished windows; otherwise, any other inspections 
may be done on witness samples. The verification shall be considered successful when the inspection 
and the optical tests show that the optical properties of each pane and the finished window stack meet or 
exceed the properties specified in JSC 66320, Optical Property Requirements for Glasses, Ceramics, and 
Plastics in Spacecraft Window Systems, consistent with tasking identified in the analysis and the visual 
uniformity inspections show that there are no readily identifiable non-uniformities in any of the 
individual panes and in the finished window stack. [V.CTS.179] 
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Q.5.9 


Window Frame Reflectance 


Window assembly frames and supporting internal and external structure within 0.15 m (~6 in) of 
the entire window perimeter shall have a flat black, low reflective surface finish that reduces 
diffuse and specular reflectance to less than 10% and 1%, respectively over a wavelength range 
of 380 to 1000 nm. [R.CTS.180] 


Rationale: Stray light, spurious specular reflections, and background reflections in the window 
are reduced when lusterless finishes are used on the window structure itself, on the structure 
around the window, and on interior surfaces opposite the window. This permits viewing through 
the window without interference from these unwanted light sources. A number of commercially 
available black coatings meet these requirements, such as Z-306 paint which has a history of use 
within other NASA programs. This paint has a diffuse reflectance of around 5% across the 
visible and infrared and a specular reflectance of less than 1%. The wavelength range is 
specified into the near infrared because some black finishes are highly reflective in the infrared. 
For detailed design considerations with respect to surface finishes, consult Section 8.6.4 in 
NASA/SP-2010-3407, Human Integration Design Handbook (HIDR), which also provides 
extensive guidance for window design considerations. The human-centered design process is to 
be used when designing windows to support crew tasks. 


Q.5.9V The presence of a flat black, lusterless finish or coating on all system window frames and 
supporting/surrounding structure within 0.15 m (~6 in) of the perimeter of any window in all directions, 
both internally and externally, shall be verified by inspection and test. The inspection shall determine 
that flat black, lusterless finish or coating has been properly applied. The verification shall be 
considered successful when the inspection shows the lusterless finish or coat is properly applied and the 
test shows that the applied lusterless finish or coating has a diffuse reflectance of less than 10% and 
specular reflectance of less than 1% for angles of incidence of 10, 30, and 60 degrees over a wavelength 
range of 380-1000 nm. [V.CTS.180] 
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Q.6: Communication System Design 
Q.6.1 Audio Volume Control 


The spacecraft shall provide a volume control from 5 to 100% of maximum for each audio 
channel carrying voice communications. [R.CTS.120] 


Rationale: The crew must have the ability to adjust volume for each audio channel in order to 
hear and communicate under expected background and radio noise conditions. For example, 
volume control with 10 steps of 6 dB increments provides acceptable range. Adjustability down 
to 5% is significant, given the maximum audio level needed for the launch noise environment, as 
it ensures that crew can adjust volume to a comfortable level in the lower SPL onorbit 
environment and have adequate speech-to-ambient noise margin. Conversely, the system must 
ensure that crew do not miss radio calls due to low audio volume or elevated background noise 
(e.g., alarms present, multiple active communications channels). Visual indicators of audio 
signal can be an effective means for alerting crew to radio calls. 


Q.6.1V The spacecraft's voice-channel volume control shall be verified by test. The test shall be made 
with flight representative hardware and software. Audio channels carrying voice shall be activated and 
the volume adjusted, while an operator speaks into the microphone at the sending station. 
Measurements shall be made, using a Type | integrating-averaging sound level meter, at expected head 
locations at the receiving station. The verification shall be considered successful when the test shows 
that the measured volume of each audio channel carrying voice communications varies 5 to 100% of 
maximum across the full range of the volume control. [V.CTS.120] 


Q.6.2 Loudspeaker Sound Limits 


Loudspeakers shall produce non-speech auditory annunciations with a sound-pressure level that 
meets the following criteria: 


a. Using measurements of A-weighted sound levels [ISO 7731:2003(E), method a) in 5.2.2.1], 
the difference between the two A-weighted sound-pressure levels of the signal and the ambient 
noise is greater than 15 dBA (LS,A-LN,A > 15 dBA). 


b. The alarm signal maximum A-weighted sound level shall not exceed 95dBA at the operating 
position of the intended receiver. 


c. The alarm signal shall be adjustable to a minimum volume of 15 dBA over the ambient noise 
environment. [R.CTS.238] 


Rationale: The specified signal-to-noise ratio ensures that non-speech auditory annunciations 
are sufficiently salient and intelligible, according to ISO 7731, Ergonomics - Danger signals for 
public work areas auditory danger signals. ISO 7731 is an accepted standard for ensuring the 
ability to detect and discriminate non-speech alarms and alerts. This requirement allows alarm 
sound levels to exceed the 85 dBA hazard limit because of the need for alarm audibility. Alarms 
can be silenced at the crew's discretion. Loudspeakers meeting these criteria can be utilized for 
alarm to arouse sleeping occupants. 
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Q.6.2V The CTS's loudspeaker non-speech auditory annunciation levels shall be verified by test. The 
test shall utilize a flight representative vehicle in the flight configuration with a range of background 
noise spectra for the mission phases in which the loudspeakers are used. Sound pressure level 
measurements shall be made with and without the loudspeaker annunciating. The test shall, also, 
evaluate the adjustment of loudspeaker volume throughout the range of background noise levels. The 
verification shall be considered successful when the test indicates that the signal is above the ambient 
noise level established in Q.6.2a by the specified amount and below the level in Q.6.2b, and volume is 
adjustable within the constraints of Q.6.2c. [V.CTS.238] 


Q.6.3 Breathing Apparatus Annunciator Intelligibility 


The CTS shall utilize, for contingency breathing apparatus, an auditory speech annunciator or 
communications system that provides a level of speech intelligibility equivalent to an 80% word 
identification rate under expected ambient noise levels. [R.CTS.352] 


Rationale: This requirement ensures that auditory speech annunciations and communications 
are sufficiently salient and intelligible. ANSI S3.2-2009, American National Standard Method 
for Measuring the Intelligibility of Speech over Communicating System is a widely accepted 
standard for measuring the intelligibility of speech communications. 


Q.6.3V For contingency breathing apparatus, auditory speech annunciations and communications 
intelligibility shall be verified by analysis and test. The analysis shall derive the nominal background 
noise spectrum for testing. The test shall be made with a flight representative vehicle in the flight 
configuration using the methodology given in ANSI S$3.2-2009. The verification shall be considered 
successful when the test and analysis indicates an 80% word identification rate at the ear of the listener 
throughout the habitable volume. [V.CTS.352] 
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